The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2654 advisory.

    - Resolves: CVE-2022-25881, CVE-2022-4904, CVE-2023-23936, CVE-2023-24807
    - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2655 advisory.

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6037:02 advisory.

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
      * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
      * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
      * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
      * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
      * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0613 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-27983:
    An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition.

    CVE-2024-27982:
    The team has identified a critical vulnerability in the http server of the most recent version of Node,     where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a     content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request     within the body of the first.

    CVE-2024-22019:
    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits.

    CVE-2023-46809:
    A flaw was found in Node.js. The privateDecrypt() API of the crypto library may allow a covert timing     side-channel during PKCS#1 v1.5 padding error handling. This issue revealed significant timing differences     in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decrypt captured RSA     ciphertexts or forge signatures, especially in scenarios involving API endpoints processing JSON Web     Encryption messages.

    CVE-2024-22025:
    A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
    The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making     it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL.
    An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration.

    CVE-2023-42282:
    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are     improperly categorized as globally routable via isPublic. A vulnerability was found in the NPM IP Package.
    This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the     isPublic() function by inducing a Server-Side Request Forgery (SSRF) attack and obtaining access to     normally inaccessible resources.

    CVE-2023-24807:
    Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has nodejs packages installed that are affected by multiple vulnerabilities:

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 14.21.3, 16.19.1, 18.14.1, 19.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Thursday February 16 2023 Security Releases advisory.

  - It was possible to bypass Permissions and access non authorized modules by using     process.mainModule.require().  This only affects users who had enabled the experimental permissions option     with --experimental-policy. Thank you, to @goums for reporting this vulnerability and thank you  Rafael     Gonzaga for fixing it. Impacts: (CVE-2023-23918)

  - In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This     may lead to false positive errors during subsequent cryptographic operations that happen to be on the same     thread. This in turn could be used to cause a denial of service. Thank you, to Morgan Jones and Ryan     Dorrity from Viasat Secure Mobile for reporting and discovering this vulnerability and thank you Rafael     Gonzaga for fixing it. Impacts: (CVE-2023-23919)

  - The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks     such as HTTP response splitting and HTTP header injection. Thank you, to Zhipeng Zhang (@timon8) for     reporting this vulnerability and thank you Robert Nagy for fixing it. Impacts: (CVE-2023-23936)

  - The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a     Expression Denial of Service (ReDoS) attacks. Thank you, to Carter Snook for reporting this vulnerability     and thank you Rich Trott for fixing it. Impacts: (CVE-2023-24807)

  - Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was     modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this. Thank you, to Ben Noordhuis for reporting     this vulnerability and thank you  Rafael Gonzaga for fixing it. Impacts: (CVE-2023-23920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0609-1 advisory.

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service. (CVE-2023-23919)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0608-1 advisory.

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service. (CVE-2023-23919)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-973319d5b7 advisory.

    Fixes for virtual Provides/Requires of `nodejs` and `nodejs-devel`

    ----

    Assorted fixes for v8-devel

    ----

    Update to 19.8.1

    Fix confilct with nodejs18


    ----

    ## 2023-02-16, Version 16.19.1 'Gallium' (LTS), @richardlau

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions     policies can be bypassed via process.mainModule (High)
    * **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL     error handling issues in nodejs crypto library (Medium)
    * **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure     loading of ICU data through ICU\_DATA environment variable (Low)

    Fixed by an update to undici:

    * **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in     Node.js did not protect against CRLF injection in host headers (Medium)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff> for more information.
    * **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression     Denial of Service in Headers in Node.js fetch API (Low)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w> for more information.

    More detailed information on each of the vulnerabilities can be found in [February 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post.

    This security release includes OpenSSL security updates as outlined in the recent     [OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt).

    ### Commits

    * \[[`7fef050447`](https://github.com/nodejs/node/commit/7fef050447)] - **build**: build ICU with     ICU\_NO\_USER\_DATA\_OVERRIDE (RafaelGSS) [nodejs-private/node-private#374](https://github.com/nodejs-     private/node-private/pull/374)
    * \[[`b558e9f476`](https://github.com/nodejs/node/commit/b558e9f476)] - **crypto**: clear OpenSSL error on     invalid ca cert (RafaelGSS) [nodejs-private/node-private#375](https://github.com/nodejs-private/node-     private/pull/375)
    * \[[`160adb7ffc`](https://github.com/nodejs/node/commit/160adb7ffc)] - **crypto**: clear OpenSSL error     queue after calling X509\_check\_private\_key() (Filip Skokan)     [#45495](https://github.com/nodejs/node/pull/45495)
    * \[[`d0ece30948`](https://github.com/nodejs/node/commit/d0ece30948)] - **crypto**: clear OpenSSL error     queue after calling X509\_verify() (Takuro Sato) [#45377](https://github.com/nodejs/node/pull/45377)
    * \[[`2d9ae4f184`](https://github.com/nodejs/node/commit/2d9ae4f184)] - **deps**: update undici to v5.19.1     (Matteo Collina) [nodejs-private/node-private#388](https://github.com/nodejs-private/node-     private/pull/388)
    * \[[`d80e8312fd`](https://github.com/nodejs/node/commit/d80e8312fd)] - **deps**: cherry-pick Windows     ARM64 fix for openssl (Richard Lau) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`de5c8d2c2f`](https://github.com/nodejs/node/commit/de5c8d2c2f)] - **deps**: update archs files for     quictls/openssl-1.1.1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`1a8ccfe908`](https://github.com/nodejs/node/commit/1a8ccfe908)] - **deps**: upgrade openssl sources     to OpenSSL\_1\_1\_1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`693789780b`](https://github.com/nodejs/node/commit/693789780b)] - **doc**: clarify release notes for     Node.js 16.19.0 (Richard Lau) [#45846](https://github.com/nodejs/node/pull/45846)
    * \[[`f95ef064f4`](https://github.com/nodejs/node/commit/f95ef064f4)] - **lib**: makeRequireFunction patch     when experimental policy (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-     private/node-private/pull/358)
    * \[[`b02d895137`](https://github.com/nodejs/node/commit/b02d895137)] - **policy**: makeRequireFunction on     mainModule.require (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-private/node-     private/pull/358)
    * \[[`d7f83c420c`](https://github.com/nodejs/node/commit/d7f83c420c)] - **test**: avoid left behind child     processes (Richard Lau) [#46276](https://github.com/nodejs/node/pull/46276)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2654 advisory.

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
    * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5533 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (16.20.2).

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236435, BZ#2178078, BZ#2223335)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

    Security Fix(es):

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
175991	Oracle Linux 9 : nodejs:18 (ELSA-2023-2654)	Nessus	Oracle Linux Local Security Checks	2023/5/17	2024/11/1	high
176395	Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2023:2655)	Nessus	Rocky Linux Local Security Checks	2023/5/25	2023/5/25	high
291908	MiracleLinux 9 : nodejs-nodemon-2.0.20-3.el9, nodejs-16.19.1-1.el9 (AXSA:2023-6037:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
239018	TencentOS Server 4: nodejs (TSSA-2024:0613)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
297073	NewStart CGSL MAIN 6.06 : nodejs Multiple Vulnerabilities (NS-SA-2025-0241)	Nessus	NewStart CGSL Local Security Checks	2026/1/28	2026/1/29	critical
171595	Node.js 14.x < 14.21.3 / 16.x < 16.19.1 / 18.x < 18.14.1 / 19.x < 19.6.1 Multiple Vulnerabilities (Thursday February 16 2023 Security Releases).	Nessus	Misc.	2023/2/17	2024/1/9	high
172097	SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2023:0609-1)	Nessus	SuSE Local Security Checks	2023/3/4	2023/7/14	high
172099	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2023:0608-1)	Nessus	SuSE Local Security Checks	2023/3/5	2023/7/14	high
173881	Fedora 38 : nodejs16 / nodejs18 / nodejs20 (2023-973319d5b7)	Nessus	Fedora Local Security Checks	2023/4/5	2024/11/14	high
175571	AlmaLinux 9 : nodejs:18 (ALSA-2023:2654)	Nessus	Alma Linux Local Security Checks	2023/5/13	2025/1/13	high
182781	RHEL 9 : nodejs (RHSA-2023:5533)	Nessus	Red Hat Local Security Checks	2023/10/9	2024/11/7	critical
189668	RHEL 8 : nodejs:18 (RHSA-2023:1583)	Nessus	Red Hat Local Security Checks	2024/1/26	2025/3/6	high

检测

插件搜索

high

high

high

critical

critical

high

high

high

high

high

critical

high