An update of the nodejs package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0703 advisory.

  - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding     is malformed (CVE-2019-15605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0703 advisory.

    The http-parser package provides a utility for parsing HTTP messages. It parses both requests and     responses. The parser is designed to be used in performance HTTP applications. It does not make any system     calls or allocations, it does not buffer data, and it can be interrupted at any time. Depending on your     architecture, it only requires about 40 bytes of data per message stream.

    Security Fix(es):

    * nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issues :

Security issues fixed :

  - CVE-2019-15604: Fixed a remotely triggerable assertion     in the TLS server via a crafted certificate string     (CVE-2019-15604, bsc#1163104).

  - CVE-2019-15605: Fixed an HTTP request smuggling     vulnerability via malformed Transfer-Encoding header     (CVE-2019-15605, bsc#1163102).

  - CVE-2019-15606: Fixed the white space sanitation of HTTP     headers (CVE-2019-15606, bsc#1163103).

This update was imported from the SUSE:SLE-15:Update update project.

Node.js reports :

Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605) Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.
HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606) Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values. Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604) Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate. Strict HTTP header parsing (None) Increase the strictness of HTTP header parsing. There are no known vulnerabilities addressed, but lax HTTP parsing has historically been a source of problems. Some commonly used sites are known to generate invalid HTTP headers, a --insecure-http-parser CLI option or insecureHTTPParser http option can be used if necessary for interoperability, but is not recommended.

Multiple vulnerabilities were discovered in Node.js, which could result in denial of service or HTTP request smuggling.

The version of http-parser installed on the remote host is prior to 2.7.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1417 advisory.

    HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding     is malformed (CVE-2019-15605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0055 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-15605:
    HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding     is malformed

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0579 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  - npm: Symlink reference outside of node_modules folder through the bin field upon installation     (CVE-2019-16775)

  - npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  - npm: Global node_modules Binary Overwrite (CVE-2019-16777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
133956	Photon OS 3.0: Nodejs PHSA-2020-3.0-0060	Nessus	PhotonOS Local Security Checks	2020/2/25	2025/8/25	critical
134238	CentOS 7 : http-parser (RHSA-2020:0703)	Nessus	CentOS Local Security Checks	2020/3/6	2024/10/9	critical
134267	RHEL 7 : http-parser (RHSA-2020:0703)	Nessus	Red Hat Local Security Checks	2020/3/6	2024/11/7	critical
134281	openSUSE Security Update : nodejs8 (openSUSE-2020-293)	Nessus	SuSE Local Security Checks	2020/3/6	2024/3/25	critical
134356	FreeBSD : Node.js -- multiple vulnerabilities (0032400f-624f-11ea-b495-000d3ab229d6)	Nessus	FreeBSD Local Security Checks	2020/3/10	2024/3/25	critical
136126	Debian DSA-4669-1 : nodejs - security update (Data Dribble) (Reset Flood) (Resource Loop)	Nessus	Debian Local Security Checks	2020/4/30	2024/3/14	critical
136361	Amazon Linux 2 : http-parser (ALAS-2020-1417)	Nessus	Amazon Linux Local Security Checks	2020/5/7	2024/12/11	critical
276423	TencentOS Server 3: http-parser (TSSA-2022:0055)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	critical
145979	CentOS 8 : nodejs:10 (CESA-2020:0579)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical