The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7675 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7350 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7350 advisory.

    nodejs     [1:24.14.1-2]
    - Update bundled nghttp2 to 1.68.1

    [1:24.14.1-1]
    - Update to version 24.14.1

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121581

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7670 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1576 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1578 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process.

    This vulnerability affects 24.x and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#assertion-error-in-node_urlcc-     via-malformed-url-format-leads-to-nodejs-crash-cve-2026-21712---medium (CVE-2026-21712)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7350 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
306516	AlmaLinux 10 : nodejs24 (ALSA-2026:7675)	Nessus	Alma Linux Local Security Checks	2026/4/15	2026/4/21	critical
305993	Photon OS 4.0: Nodejs PHSA-2026-4.0-0995	Nessus	PhotonOS Local Security Checks	2026/4/11	2026/4/11	medium
305802	RockyLinux 9 : nodejs:24 (RLSA-2026:7350)	Nessus	Rocky Linux Local Security Checks	2026/4/9	2026/4/15	critical
307038	Oracle Linux 9 : nodejs:24 (ELSA-2026-7350)	Nessus	Oracle Linux Local Security Checks	2026/4/17	2026/4/17	critical
306066	RHEL 8 : nodejs:24 (RHSA-2026:7670)	Nessus	Red Hat Local Security Checks	2026/4/13	2026/4/13	high
306217	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1576)	Nessus	Amazon Linux Local Security Checks	2026/4/13	2026/4/13	medium
306235	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1578)	Nessus	Amazon Linux Local Security Checks	2026/4/13	2026/4/13	high
305798	RHEL 9 : nodejs:24 (RHSA-2026:7350)	Nessus	Red Hat Local Security Checks	2026/4/9	2026/4/9	critical

检测

插件搜索

critical

medium

critical

critical

high

medium

high

critical