The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0608-1 advisory.

    Update to LTS version 16.19.1:

    - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule     (bsc#1208481).
    - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
    - CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
    - CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
    - CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and     Headers.append() methods (bsc#1208413).

    Bug fixes:

    - Workaround for failing openssl-nodejs test (bsc#1205568).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-973319d5b7 advisory.

    Fixes for virtual Provides/Requires of `nodejs` and `nodejs-devel`

    ----

    Assorted fixes for v8-devel

    ----

    Update to 19.8.1

    Fix confilct with nodejs18


    ----

    ## 2023-02-16, Version 16.19.1 'Gallium' (LTS), @richardlau

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions     policies can be bypassed via process.mainModule (High)
    * **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL     error handling issues in nodejs crypto library (Medium)
    * **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure     loading of ICU data through ICU\_DATA environment variable (Low)

    Fixed by an update to undici:

    * **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in     Node.js did not protect against CRLF injection in host headers (Medium)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff> for more information.
    * **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression     Denial of Service in Headers in Node.js fetch API (Low)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w> for more information.

    More detailed information on each of the vulnerabilities can be found in [February 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post.

    This security release includes OpenSSL security updates as outlined in the recent     [OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt).

    ### Commits

    * \[[`7fef050447`](https://github.com/nodejs/node/commit/7fef050447)] - **build**: build ICU with     ICU\_NO\_USER\_DATA\_OVERRIDE (RafaelGSS) [nodejs-private/node-private#374](https://github.com/nodejs-     private/node-private/pull/374)
    * \[[`b558e9f476`](https://github.com/nodejs/node/commit/b558e9f476)] - **crypto**: clear OpenSSL error on     invalid ca cert (RafaelGSS) [nodejs-private/node-private#375](https://github.com/nodejs-private/node-     private/pull/375)
    * \[[`160adb7ffc`](https://github.com/nodejs/node/commit/160adb7ffc)] - **crypto**: clear OpenSSL error     queue after calling X509\_check\_private\_key() (Filip Skokan)     [#45495](https://github.com/nodejs/node/pull/45495)
    * \[[`d0ece30948`](https://github.com/nodejs/node/commit/d0ece30948)] - **crypto**: clear OpenSSL error     queue after calling X509\_verify() (Takuro Sato) [#45377](https://github.com/nodejs/node/pull/45377)
    * \[[`2d9ae4f184`](https://github.com/nodejs/node/commit/2d9ae4f184)] - **deps**: update undici to v5.19.1     (Matteo Collina) [nodejs-private/node-private#388](https://github.com/nodejs-private/node-     private/pull/388)
    * \[[`d80e8312fd`](https://github.com/nodejs/node/commit/d80e8312fd)] - **deps**: cherry-pick Windows     ARM64 fix for openssl (Richard Lau) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`de5c8d2c2f`](https://github.com/nodejs/node/commit/de5c8d2c2f)] - **deps**: update archs files for     quictls/openssl-1.1.1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`1a8ccfe908`](https://github.com/nodejs/node/commit/1a8ccfe908)] - **deps**: upgrade openssl sources     to OpenSSL\_1\_1\_1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`693789780b`](https://github.com/nodejs/node/commit/693789780b)] - **doc**: clarify release notes for     Node.js 16.19.0 (Richard Lau) [#45846](https://github.com/nodejs/node/pull/45846)
    * \[[`f95ef064f4`](https://github.com/nodejs/node/commit/f95ef064f4)] - **lib**: makeRequireFunction patch     when experimental policy (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-     private/node-private/pull/358)
    * \[[`b02d895137`](https://github.com/nodejs/node/commit/b02d895137)] - **policy**: makeRequireFunction on     mainModule.require (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-private/node-     private/pull/358)
    * \[[`d7f83c420c`](https://github.com/nodejs/node/commit/d7f83c420c)] - **test**: avoid left behind child     processes (Richard Lau) [#46276](https://github.com/nodejs/node/pull/46276)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2654 advisory.

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
    * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

    Security Fix(es):

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150103 advisory.

    A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
172099	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2023:0608-1)	Nessus	SuSE Local Security Checks	2023/3/5	2026/6/26	high
173881	Fedora 38 : nodejs16 / nodejs18 / nodejs20 (2023-973319d5b7)	Nessus	Fedora Local Security Checks	2023/4/5	2024/11/14	high
175571	AlmaLinux 9 : nodejs:18 (ALSA-2023:2654)	Nessus	Alma Linux Local Security Checks	2023/5/13	2025/1/13	high
189668	RHEL 8 : nodejs:18 (RHSA-2023:1583)	Nessus	Red Hat Local Security Checks	2024/1/26	2025/3/6	high
332189	Photon OS 5.0: Nodejs PHSA-2023-5.0-91-0011	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	high
375212	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150103)	Nessus	Unity Linux Local Security Checks	2026/11/2	2026/11/2	high

检测

插件搜索

high

high

high

high

high

high