The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write`     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
    This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. (CVE-2025-55130)

  - Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply     the expected write-permission checks, which means file metadata can be modified in read-only directories.
    This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of     logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
    (CVE-2025-55132)

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5cd409edfa advisory.

    Update to version 24.13.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f601b2f60a advisory.

    Update to version 20.20.0

    ----

    Update to version 20.19.6




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cc863e84da advisory.

    Update to version 24.13.0.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1403 advisory.

    Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption.

    While exploitation typically requires precise timing or in-process code execution, it can become remotely     exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality     and integrity impact. (CVE-2025-55131)

    fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

    Uncatchable Maximum call stack size exceeded error on Node.js via async_hooks leads to process crashes     bypassing error handlers (CVE-2025-59466)

    TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

    NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-     exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1842 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1842 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1842 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1843 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2422 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2421 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2781 advisory.

    nodejs     [1:24.13.0-1]
    - Update to version 24.13.0

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121581

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2781 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-209:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-212:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
310403	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	2026/4/27	2026/4/28	high
283725	Linux Distros Unpatched Vulnerability : CVE-2025-55132	Nessus	Misc.	2026/1/14	2026/6/10	medium
297441	Fedora 43 : nodejs24 (2026-5cd409edfa)	Nessus	Fedora Local Security Checks	2026/1/31	2026/4/3	medium
297442	Fedora 43 : nodejs20 (2026-f601b2f60a)	Nessus	Fedora Local Security Checks	2026/1/31	2026/4/3	high
297444	Fedora 42 : nodejs24 (2026-cc863e84da)	Nessus	Fedora Local Security Checks	2026/1/31	2026/4/3	medium
298096	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1403)	Nessus	Amazon Linux Local Security Checks	2026/2/5	2026/4/3	medium
298159	RHEL 10 : nodejs24 (RHSA-2026:1842)	Nessus	Red Hat Local Security Checks	2026/2/5	2026/4/3	medium
298205	RockyLinux 10 : nodejs24 (RLSA-2026:1842)	Nessus	Rocky Linux Local Security Checks	2026/2/6	2026/4/3	medium
298352	Photon OS 5.0: Nodejs PHSA-2026-5.0-0755	Nessus	PhotonOS Local Security Checks	2026/2/9	2026/4/3	medium
298508	AlmaLinux 10 : nodejs24 (ALSA-2026:1842)	Nessus	Alma Linux Local Security Checks	2026/2/10	2026/4/21	medium
298509	AlmaLinux 10 : nodejs22 (ALSA-2026:1843)	Nessus	Alma Linux Local Security Checks	2026/2/10	2026/4/3	medium
298618	RockyLinux 8 : nodejs:20 (RLSA-2026:2422)	Nessus	Rocky Linux Local Security Checks	2026/2/11	2026/4/3	medium
299015	AlmaLinux 8 : nodejs:22 (ALSA-2026:2421)	Nessus	Alma Linux Local Security Checks	2026/2/13	2026/4/3	medium
299336	Oracle Linux 9 : nodejs:24 (ELSA-2026-2781)	Nessus	Oracle Linux Local Security Checks	2026/2/17	2026/4/3	medium
299389	RockyLinux 9 : nodejs:24 (RLSA-2026:2781)	Nessus	Rocky Linux Local Security Checks	2026/2/18	2026/4/3	medium
299682	MiracleLinux 9 : nodejs:24 (AXSA:2026-209:01)	Nessus	Miracle Linux Local Security Checks	2026/2/20	2026/4/3	medium
299684	MiracleLinux 9 : nodejs:22 (AXSA:2026-212:01)	Nessus	Miracle Linux Local Security Checks	2026/2/20	2026/4/3	medium

检测

插件搜索

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium