The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1443 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1613 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1613 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1613 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793183117 advisory.

  - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds. (CVE-2023-45143)

  - Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3,     undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the     output of `Math.random()` can be predicted if several of its generated values are known. If there is a     mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to     leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs     if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do     not issue multipart requests to attacker controlled servers. (CVE-2025-22150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
216378	AlmaLinux 9 : nodejs:20 (ALSA-2025:1443)	Nessus	Alma Linux Local Security Checks	2025/2/17	2025/2/17	high
216401	RHEL 9 : nodejs:22 (RHSA-2025:1613)	Nessus	Red Hat Local Security Checks	2025/2/17	2025/6/5	high
216420	AlmaLinux 9 : nodejs:22 (ALSA-2025:1613)	Nessus	Alma Linux Local Security Checks	2025/2/18	2025/5/16	high
216872	RockyLinux 9 : nodejs:22 (RLSA-2025:1613)	Nessus	Rocky Linux Local Security Checks	2025/2/26	2025/2/26	high
373061	AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793183117)	Nessus	Alma Linux Local Security Checks	2026/10/28	2026/10/28	low

检测

插件搜索

high

high

high

high

low