The version of nodejs / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22020 advisory.

  - A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0247 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-39331:
    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The     new path traversal vulnerability arises because the implementation does not protect itself against the     application overwriting built-in utility functions with user-defined implementations.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2023-39332:
    Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects.
    This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability     follows the same pattern using `Uint8Array` instead of `Buffer`.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21890:
    The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example:
    ```
    --allow-fs-read=/home/node/.ssh/*.pub     ```     will ignore `pub` and give access to everything after `.ssh/`.
    This misleading documentation affects all users using the experimental permission model in Node.js 20 and     Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21891:
    Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21896:
    The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-22017:
    setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid().
    This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0     and Node.js 21.

    CVE-2024-22018:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used.
    This flaw arises from an inadequate permission model that fails to restrict file stats through the     fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit     read access to.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-22020:
    A security flaw in Node.js  allows a bypass of network import restrictions.
    By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system     security.
    Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
    Exploiting this flaw can violate network import security, posing a risk to developers and servers.

    CVE-2024-28863:
    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders.

    CVE-2024-36137:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.
    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has nodejs packages installed that are affected by multiple vulnerabilities:

  - A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

  - node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

  - A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY     notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be     terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption     and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users     on Node.js v18.x, v20.x, v22.x and v23.x. (CVE-2025-23085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8725:01 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
      * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
      * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
      * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
216287	CBL Mariner 2.0 Security Update: nodejs / nodejs18 (CVE-2024-22020)	Nessus	MarinerOS Local Security Checks	2025/2/14	2025/2/21	medium
236198	Alibaba Cloud Linux 3 : 0247: nodejs:20 (ALINUX3-SA-2024:0247)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
242782	NewStart CGSL MAIN 7.02 : nodejs Multiple Vulnerabilities (NS-SA-2025-0123)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
293326	MiracleLinux 8 : nodejs:20 (AXSA:2024-8725:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

critical

medium

medium