The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7b52921cae advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

    ----

    ## 2023-09-28, Version 20.8.0 (Current), @ruyadorno

    ### Notable Changes

    #### Stream performance improvements

    Performance improvements to writable and readable streams, improving the creation and destruction by 15%     and reducing the memory overhead each stream takes in Node.js

    Contributed by Benjamin Gruenbaum in [#49745](https://github.com/nodejs/node/pull/49745) and Raz Luvaton     in [#49834](https://github.com/nodejs/node/pull/49834).

    Performance improvements for readable webstream, improving readable stream async iterator consumption by     140% and improving readable stream `pipeTo` consumption by 60%

    Contributed by Raz Luvaton in [#49662](https://github.com/nodejs/node/pull/49662) and     [#49690](https://github.com/nodejs/node/pull/49690).

    #### Rework of memory management in `vm` APIs with the `importModuleDynamically` option

    This rework addressed a series of long-standing memory leaks and use-after-free issues in the following     APIs that support `importModuleDynamically`:

    * `vm.Script`
    * `vm.compileFunction`
    * `vm.SyntheticModule`
    * `vm.SourceTextModule`

    This should enable affected users (in particular Jest users) to upgrade from older versions of Node.js.

    Contributed by Joyee Cheung in [#48510](https://github.com/nodejs/node/pull/48510).

    #### Other notable changes

    * \[[`32d4d29d02`](https://github.com/nodejs/node/commit/32d4d29d02)] - **deps**: add     v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung)     [#49874](https://github.com/nodejs/node/pull/49874)
    * \[[`0e686d096b`](https://github.com/nodejs/node/commit/0e686d096b)] - **doc**: deprecate `fs.F_OK`,     `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) [#49683](https://github.com/nodejs/node/pull/49683)
    * \[[`a5dd057540`](https://github.com/nodejs/node/commit/a5dd057540)] - **doc**: deprecate     `util.toUSVString` (Yagiz Nizipli) [#49725](https://github.com/nodejs/node/pull/49725)
    * \[[`7b6a73172f`](https://github.com/nodejs/node/commit/7b6a73172f)] - **doc**: deprecate calling     `promisify` on a function that returns a promise (Antoine du Hamel)     [#49647](https://github.com/nodejs/node/pull/49647)
    * \[[`1beefd5f16`](https://github.com/nodejs/node/commit/1beefd5f16)] - **esm**: set all hooks as release     candidate (Geoffrey Booth) [#49597](https://github.com/nodejs/node/pull/49597)
    * \[[`b0ce78a75b`](https://github.com/nodejs/node/commit/b0ce78a75b)] - **module**: fix the leak in     SourceTextModule and ContextifySript (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`4e578f8ab1`](https://github.com/nodejs/node/commit/4e578f8ab1)] - **module**: fix leak of     vm.SyntheticModule (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`69e4218772`](https://github.com/nodejs/node/commit/69e4218772)] - **module**: use symbol in WeakMap     to manage host defined options (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`14ece0aa76`](https://github.com/nodejs/node/commit/14ece0aa76)] - **(SEMVER-MINOR)** **src**: allow     embedders to override NODE\_MODULE\_VERSION (Cheng Zhao)     [#49279](https://github.com/nodejs/node/pull/49279)
    * \[[`9fd67fbff0`](https://github.com/nodejs/node/commit/9fd67fbff0)] - **stream**: use bitmap in writable     state (Raz Luvaton) [#49834](https://github.com/nodejs/node/pull/49834)
    * \[[`0ccd4638ac`](https://github.com/nodejs/node/commit/0ccd4638ac)] - **stream**: use bitmap in readable     state (Benjamin Gruenbaum) [#49745](https://github.com/nodejs/node/pull/49745)
    * \[[`7c5e322346`](https://github.com/nodejs/node/commit/7c5e322346)] - **stream**: improve webstream     readable async iterator performance (Raz Luvaton) [#49662](https://github.com/nodejs/node/pull/49662)
    * \[[`80b342cc38`](https://github.com/nodejs/node/commit/80b342cc38)] - **(SEMVER-MINOR)**
    **test\_runner**: accept `testOnly` in `run` (Moshe Atlow)     [#49753](https://github.com/nodejs/node/pull/49753)
    * \[[`17a05b141d`](https://github.com/nodejs/node/commit/17a05b141d)] - **(SEMVER-MINOR)**
    **test\_runner**: add junit reporter (Moshe Atlow) [#49614](https://github.com/nodejs/node/pull/49614)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0256 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-38552:
      When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check.
      Impacts:
      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 18.x and, 20.x.
      Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

      CVE-2023-39333:
      Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module.

      CVE-2023-44487:
      The HTTP/2 protocol allows a denial of service (server resource consumption) because request     cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

      CVE-2023-45143:
      Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design,     cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser     environments. Since undici handles headers more liberally than the spec, there was a disconnect from the     assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental     leakage of cookie to a third-party site or a malicious attacker who can control the redirection target     (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2.
    There are no known workarounds.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0614 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-45143:
    Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds.

    CVE-2023-39332:
    Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects.

    This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability     follows the same pattern using `Uint8Array` instead of `Buffer`.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2023-38552:
    When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check.
    Impacts:
    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    18.x and, 20.x.
    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    CVE-2023-32559:
    A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-32006:
    The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module.

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x, and, 20.x.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-32002:
    The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-30590:
    The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values.

    The documented behavior is very different from the actual behavior, and this difference could easily lead     to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for     application-level security, implications are consequently broad.

    CVE-2023-30588:
    When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

    CVE-2023-30581:
    The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

    CVE-2023-39333:
    Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module.

    CVE-2023-23918:
    A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy.

    CVE-2023-23920:
    An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.

    CVE-2022-25881:
    This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library.

    CVE-2023-23919:
    A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service.

    CVE-2023-30589:
    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According     to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js     active versions: v16, v18, and, v20

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5869 advisory.

    nodejs     [1:18.18.2-1]
    - Rebase to version 18.18.2       Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4155-1 advisory.

    - Update to version 18.18.2
    - CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
    - CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
    - CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented.
    (bsc#1216272)
    - CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-dbe64661af advisory.

    ## 2023-10-13, Version 18.18.2 'Hydrogen' (LTS), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7205 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

    * nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

    * nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

    * nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

    * nodejs: code injection via WebAssembly export names (CVE-2023-39333)

    * node-undici: cookie leakage (CVE-2023-45143)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7205 advisory.

  - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time     this CVE was issued, the policy mechanism is an experimental feature of Node.js. (CVE-2023-38552)

  - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The     new path traversal vulnerability arises because the implementation does not protect itself against the     application overwriting built-in utility functions with user-defined implementations. Please note that at     the time this CVE was issued, the permission model is an experimental feature of Node.js. (CVE-2023-39331)

  - Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects.
    However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note     that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
    (CVE-2023-39332)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds. (CVE-2023-45143)

  - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module. Impacts: Thanks to dittyroma     for reporting the issue and to Tobias Nieen for fixing it. (CVE-2023-39333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6526:01 advisory.

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)     A Asianux Security Bulletin which addresses further details about this flaw is available in the References     section.
      * nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
      * nodejs: code injection via WebAssembly export names (CVE-2023-39333)
      * node-undici: cookie leakage (CVE-2023-45143)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
185303	Fedora 39 : nodejs20 (2023-7b52921cae)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	critical
239153	TencentOS Server 3: nodejs:18 (TSSA-2023:0256)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	medium
239784	TencentOS Server 4: nodejs (TSSA-2024:0614)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
183740	Oracle Linux 8 : nodejs:18 (ELSA-2023-5869)	Nessus	Oracle Linux Local Security Checks	2023/10/23	2025/9/9	medium
183765	SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2023:4155-1)	Nessus	SuSE Local Security Checks	2023/10/24	2026/6/26	medium
185295	Fedora 39 : nodejs18 (2023-dbe64661af)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	critical
185689	RHEL 8 : nodejs:20 (RHSA-2023:7205)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/3/6	critical
186401	Rocky Linux 8 : nodejs:20 (RLSA-2023:7205)	Nessus	Rocky Linux Local Security Checks	2023/11/28	2024/2/9	critical
292367	MiracleLinux 8 : nodejs:18 (AXSA:2023-6526:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

critical

medium

critical

medium

medium

critical

critical

critical

medium