The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2781 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20236-1 advisory.

    Update to 22.22.0:

    - CVE-2025-55130: file system permissions bypass via crafted symlinks (bsc#1256569).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-55132: a file's access and modification timestamps can be changed via `futimes()` even when the     process has only read permissions (bsc#1256571).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error (bsc#1256573).
    - CVE-2025-59466: uncatchable Maximum call stack size exceeded error when `async_hooks.createHook()` is     enabled can lead to crash (bsc#1256574).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths and can cause a denial of service (bsc#1256576).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource exhaustion (bsc#1256848).

    For full changelog, please see https://nodejs.org/en/blog

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2783 advisory.

    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6166 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6166-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 17, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nodejs     CVE ID         : CVE-2025-23085 CVE-2025-55130 CVE-2025-55131 CVE-2025-55132                      CVE-2025-59465 CVE-2025-59466 CVE-2026-21637

    Multiple vulnerabilities were discovered in Node.js, which could result     in denial of service or information disclosure or bypass of file     restrictions.

    For the stable distribution (trixie), these problems have been fixed in     version 20.19.2+dfsg-1+deb13u1.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
299308	RHEL 9 : nodejs:24 (RHSA-2026:2781)	Nessus	Red Hat Local Security Checks	2026/2/17	2026/4/3	medium
299359	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:20236-1)	Nessus	SuSE Local Security Checks	2026/2/18	2026/4/3	medium
299581	Oracle Linux 9 : nodejs:20 (ELSA-2026-2783)	Nessus	Oracle Linux Local Security Checks	2026/2/19	2026/4/3	medium
302817	Debian dsa-6166 : libnode-dev - security update	Nessus	Debian Local Security Checks	2026/3/17	2026/3/18	medium

检测

插件搜索

medium

medium

medium

medium