The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5849 advisory.

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)
    * nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
    * nodejs: code injection via WebAssembly export names (CVE-2023-39333)
    * node-undici: cookie leakage (CVE-2023-45143)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4132-1 advisory.

    - Update to version 18.18.2
    - CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
    - CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
    - CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented.
    (bsc#1216272)
    - CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5849 advisory.

    - Rebase to version 18.18.2       Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333

    nodejs-nodemon
    - Resolves: CVE-2022-25883

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e9c04d81c1 advisory.

    ## 2023-10-13, Version 18.18.2 'Hydrogen' (LTS), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-11 (Node.js: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6525:01 advisory.

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)
      * nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
      * nodejs: code injection via WebAssembly export names (CVE-2023-39333)
      * node-undici: cookie leakage (CVE-2023-45143)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds. (CVE-2023-45143)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 18.18.2, 20.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Friday October 13 2023 Security Releases advisory.

  - Undici did not always clear Cookie headers on cross-origin redirects. By design, cookie headers are     forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments.
    Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the     spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to     a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector)     to leak the cookie to the 3rd party site. More details area available in GHSA-wqq4-5wpv-mx2g     (CVE-2023-45143)

  - Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound     causes denial of service. See https://www.cve.org/CVERecord?id=CVE-2023-44487 for details. Impacts:
    (CVE-2023-44487)

  - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The new path traversal     vulnerability arises because the implementation does not protect itself against the application     overwriting built-in utility functions with user-defined implementations. Impacts: Please note that at the     time this CVE is issued, the permission model is an experimental feature of Node.js. Thanks to Tobias     Nieen who reported and created the security patch. (CVE-2023-39331)

  - Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js     environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer     Uint8Array objects. This is distinct from CVE-2023-32004 (report 2038134), which only referred to Buffer     objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer. Impacts:
    Please note that at the time this CVE is issued, the permission model is an experimental feature of     Node.js. Thanks to Tobias Nieen who reported and created the security patch. (CVE-2023-39332)

  - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to node's policy implementation, thus     effectively disabling the integrity check. Impacts: Please note that at the time this CVE is issued, the     policy mechanism is an experimental feature of Node.js. Thanks to Tobias Nieen who reported and created     the security patch. (CVE-2023-38552)

  - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module. Impacts: Thanks to dittyroma     for reporting the issue and to Tobias Nieen for fixing it. (CVE-2023-39333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4150-1 advisory.

    - Update to version 18.18.2
    - CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
    - CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
    - CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented.
    (bsc#1216272)
    - CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d5030c983c advisory.

    ## 2023-10-13, Version 18.18.2 'Hydrogen' (LTS), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4d2fd884ea advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7b52921cae advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

    ----

    ## 2023-09-28, Version 20.8.0 (Current), @ruyadorno

    ### Notable Changes

    #### Stream performance improvements

    Performance improvements to writable and readable streams, improving the creation and destruction by 15%     and reducing the memory overhead each stream takes in Node.js

    Contributed by Benjamin Gruenbaum in [#49745](https://github.com/nodejs/node/pull/49745) and Raz Luvaton     in [#49834](https://github.com/nodejs/node/pull/49834).

    Performance improvements for readable webstream, improving readable stream async iterator consumption by     140% and improving readable stream `pipeTo` consumption by 60%

    Contributed by Raz Luvaton in [#49662](https://github.com/nodejs/node/pull/49662) and     [#49690](https://github.com/nodejs/node/pull/49690).

    #### Rework of memory management in `vm` APIs with the `importModuleDynamically` option

    This rework addressed a series of long-standing memory leaks and use-after-free issues in the following     APIs that support `importModuleDynamically`:

    * `vm.Script`
    * `vm.compileFunction`
    * `vm.SyntheticModule`
    * `vm.SourceTextModule`

    This should enable affected users (in particular Jest users) to upgrade from older versions of Node.js.

    Contributed by Joyee Cheung in [#48510](https://github.com/nodejs/node/pull/48510).

    #### Other notable changes

    * \[[`32d4d29d02`](https://github.com/nodejs/node/commit/32d4d29d02)] - **deps**: add     v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung)     [#49874](https://github.com/nodejs/node/pull/49874)
    * \[[`0e686d096b`](https://github.com/nodejs/node/commit/0e686d096b)] - **doc**: deprecate `fs.F_OK`,     `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) [#49683](https://github.com/nodejs/node/pull/49683)
    * \[[`a5dd057540`](https://github.com/nodejs/node/commit/a5dd057540)] - **doc**: deprecate     `util.toUSVString` (Yagiz Nizipli) [#49725](https://github.com/nodejs/node/pull/49725)
    * \[[`7b6a73172f`](https://github.com/nodejs/node/commit/7b6a73172f)] - **doc**: deprecate calling     `promisify` on a function that returns a promise (Antoine du Hamel)     [#49647](https://github.com/nodejs/node/pull/49647)
    * \[[`1beefd5f16`](https://github.com/nodejs/node/commit/1beefd5f16)] - **esm**: set all hooks as release     candidate (Geoffrey Booth) [#49597](https://github.com/nodejs/node/pull/49597)
    * \[[`b0ce78a75b`](https://github.com/nodejs/node/commit/b0ce78a75b)] - **module**: fix the leak in     SourceTextModule and ContextifySript (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`4e578f8ab1`](https://github.com/nodejs/node/commit/4e578f8ab1)] - **module**: fix leak of     vm.SyntheticModule (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`69e4218772`](https://github.com/nodejs/node/commit/69e4218772)] - **module**: use symbol in WeakMap     to manage host defined options (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`14ece0aa76`](https://github.com/nodejs/node/commit/14ece0aa76)] - **(SEMVER-MINOR)** **src**: allow     embedders to override NODE\_MODULE\_VERSION (Cheng Zhao)     [#49279](https://github.com/nodejs/node/pull/49279)
    * \[[`9fd67fbff0`](https://github.com/nodejs/node/commit/9fd67fbff0)] - **stream**: use bitmap in writable     state (Raz Luvaton) [#49834](https://github.com/nodejs/node/pull/49834)
    * \[[`0ccd4638ac`](https://github.com/nodejs/node/commit/0ccd4638ac)] - **stream**: use bitmap in readable     state (Benjamin Gruenbaum) [#49745](https://github.com/nodejs/node/pull/49745)
    * \[[`7c5e322346`](https://github.com/nodejs/node/commit/7c5e322346)] - **stream**: improve webstream     readable async iterator performance (Raz Luvaton) [#49662](https://github.com/nodejs/node/pull/49662)
    * \[[`80b342cc38`](https://github.com/nodejs/node/commit/80b342cc38)] - **(SEMVER-MINOR)**
    **test\_runner**: accept `testOnly` in `run` (Moshe Atlow)     [#49753](https://github.com/nodejs/node/pull/49753)
    * \[[`17a05b141d`](https://github.com/nodejs/node/commit/17a05b141d)] - **(SEMVER-MINOR)**
    **test\_runner**: add junit reporter (Moshe Atlow) [#49614](https://github.com/nodejs/node/pull/49614)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0256 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-38552:
      When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check.
      Impacts:
      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 18.x and, 20.x.
      Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

      CVE-2023-39333:
      Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module.

      CVE-2023-44487:
      The HTTP/2 protocol allows a denial of service (server resource consumption) because request     cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

      CVE-2023-45143:
      Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design,     cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser     environments. Since undici handles headers more liberally than the spec, there was a disconnect from the     assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental     leakage of cookie to a third-party site or a malicious attacker who can control the redirection target     (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2.
    There are no known workarounds.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
183422	AlmaLinux 9 : nodejs:18 (ALSA-2023:5849)	Nessus	Alma Linux Local Security Checks	2023/10/19	2025/1/13	critical
183498	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2023:4132-1)	Nessus	SuSE Local Security Checks	2023/10/20	2026/6/26	medium
183742	Oracle Linux 9 : 18 (ELSA-2023-5849)	Nessus	Oracle Linux Local Security Checks	2023/10/23	2025/9/9	medium
183906	Fedora 37 : nodejs18 (2023-e9c04d81c1)	Nessus	Fedora Local Security Checks	2023/10/26	2024/11/14	critical
236407	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/5/14	2025/5/17	critical
292633	MiracleLinux 9 : nodejs:18 (AXSA:2023-6525:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
226859	Linux Distros Unpatched Vulnerability : CVE-2023-45143	Nessus	Misc.	2025/3/5	2026/7/30	low
183390	Node.js 18.x < 18.18.2 / 20.x < 20.8.1 Multiple Vulnerabilities (Friday October 13 2023 Security Releases).	Nessus	Misc.	2023/10/19	2024/2/23	critical
183661	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2023:4150-1)	Nessus	SuSE Local Security Checks	2023/10/21	2026/6/26	medium
183761	Fedora 38 : nodejs18 (2023-d5030c983c)	Nessus	Fedora Local Security Checks	2023/10/24	2024/11/14	critical
183909	Fedora 38 : nodejs20 (2023-4d2fd884ea)	Nessus	Fedora Local Security Checks	2023/10/26	2024/11/14	critical
185303	Fedora 39 : nodejs20 (2023-7b52921cae)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	critical
239153	TencentOS Server 3: nodejs:18 (TSSA-2023:0256)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	medium

检测

插件搜索

critical

medium

medium

critical

critical

medium

low

critical

medium

critical

critical

critical

medium