It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits     exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who     passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and     event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the     recursion work. (CVE-2026-13149)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the     Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,     and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,     stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject     CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the     upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is     unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from     user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and     CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length     header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,     from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can     return a partial response with a mismatched framing header, close the socket early, and have the retry     interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as     proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to     downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the     retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder     that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and     8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0     up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and     entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie     attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and     an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications     that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope     session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,     HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-16729)

    A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before     check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial     of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches     sqlite3_value_type() with a NULL sqlite3_value pointer. (CVE-2026-50812)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace     Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security     boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client     certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname     verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects     Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than     256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling     to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects     Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-     can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-     on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a     checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make     no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha     function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value     that triggers the function's regex replacement and string-manipulation logic,  causing excessive CPU     consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_75870 advisory.

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75864 advisory.

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
      * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75870 advisory.

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
      * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_76750 advisory.

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76750 advisory.

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
      * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84703 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1432 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-9496:
    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha     function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value     that triggers the functions regex replacement and string-manipulation logic,  causing excessive CPU     consumption and potentially stalling or crashing the process.

    CVE-2026-19534:
    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server     responds with a subprotocol that the client never requested. A default WebSocket connection sends no     subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici     dereferences a null value while checking it against the requested list and throws an uncaught TypeError.
    Because that code runs inside a microtask with no surrounding error handling, the exception propagates and     terminates the process under Node's default behavior, instead of gracefully failing the connection as     required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or     compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed     remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up     to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1,     7.29.1, or 8.10.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2141 advisory.

    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha     function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value     that triggers the function's regex replacement and string-manipulation logic,  causing excessive CPU     consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory.

  - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via     the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted     spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing     excessive CPU consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84589 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21058-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
337205	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/26	critical
363153	Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_75870)	Nessus	Rocky Linux Local Security Checks	2026/10/6	2026/10/9	high
363410	AlmaLinux 10 : nodejs22 (ALSA-2026:75864)	Nessus	Alma Linux Local Security Checks	2026/10/6	2026/10/13	high
363935	AlmaLinux 8 : nodejs:22 (ALSA-2026:75870)	Nessus	Alma Linux Local Security Checks	2026/10/7	2026/10/9	high
364369	Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_76750)	Nessus	Rocky Linux Local Security Checks	2026/10/9	2026/10/13	high
366098	AlmaLinux 9 : nodejs:22 (ALSA-2026:76750)	Nessus	Alma Linux Local Security Checks	2026/10/15	2026/10/29	high
367225	RHEL 10 : nodejs22 (RHSA-2026:84703)	Nessus	Red Hat Local Security Checks	2026/10/19	2026/10/29	high
379301	TencentOS Server 3: nodejs:22 (TSSA-2026:1432)	Nessus	Tencent Local Security Checks	2026/11/11	2026/11/11	high
345800	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2141)	Nessus	Amazon Linux Local Security Checks	2026/9/14	2026/10/13	high
368048	Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)	Nessus	Rocky Linux Local Security Checks	2026/10/20	2026/10/29	high
367282	RHEL 9 : nodejs:22 (RHSA-2026:84589)	Nessus	Red Hat Local Security Checks	2026/10/19	2026/10/29	high
324066	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21058-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/10/13	high
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	2026/7/9	2026/10/13	high

检测

插件搜索

critical

high

high

high

high

high

high

high

high

high

high

high

high