There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

遠端主機上安裝的 Node.js 版本早24.x24.22.1於或26.x早於 26.12.1。因此，它會受到 2026 年 10 月 21 日星期三安全性版本公告中所述的 TLS 憑證主機名稱繞過弱點的影響。

  - 使用全角數字寫入 IP 位址時，可以繞過 TLS 憑證主機名稱驗證。（CVE-2026-105483）

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Node.js TLS 主機名稱驗證中的缺陷，當主機以非 ASCII 字元 （例如全角數字 （.0.0.1） 寫入主機時，允許沒有相符 IP 位址 SAN 的憑證驗證與 IPv4 位址的連線。tls.checkServerIdentity（） 不會將此類主機識別為 IP 位址，即使它們正規化並解析為一般 IPv4 位址，並改為將它們與憑證 DNS 名稱和通用名稱進行比對。因此，包含 DNS：127.0.0.1 或 DNS：*.0.0.1 的憑證可能會被接受用於未核發的 IP 端點。這是修正之後引入 CVE-2026-48618的迴歸。此弱點會影響 Node.js 26.x 和 24.x。感謝 Hasan Flayyih Abdullah 報告此漏洞，並感謝 jasnell 修復它。（CVE-2026-105483）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程主机上安装的 Node.js 版本低于或26.x低于 24.x24.22.126.12.1。因此，如 2026 年 10 月 21 日星期三安全发布公告所述，受到 TLS 证书主机名绕过漏洞的影响。

  - 使用全角数字写入 IP 地址时，可绕过 TLS 证书主机名验证。（CVE-2026-105483）

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Node.js TLS 主机名验证中的缺陷允许在主机使用非 ASCII 字符（如全角数字 .0.0.1）写入时，没有匹配 IP 地址 SAN 的证书认证与 IPv4 地址的连接。tls.checkServerIdentity（） 不将此类主机识别为 IP 地址，即使它们规范化并解析为常规 IPv4 地址，而是将它们与证书 DNS 名称和公用名进行匹配。因此，包含 DNS：127.0.0.1 或 DNS：*.0.0.1 的证书可被接受用于未颁发它的 IP 端点。这是在针对 的 CVE-2026-48618补丁之后引入的回归。此漏洞影响 Node.js 26.x 和 24.x。感谢 Hasan Flayyih Abdullah 报告此漏洞，并感谢 jasnell 修复此漏洞。（CVE-2026-105483）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされているNode.jsのバージョンは、24.22.1より前の24.xまたは26.12.1より前の26.xです。したがって、2026年10月21日水曜日のセキュリティリリースアドバイザリに記載されているTLS証明書のホスト名バイパスの脆弱性の影響を受けます。

  - IP アドレスが全角の数字で書かれている場合、TLS 証明書のホスト名の検証がバイパスされる可能性があります。(CVE-2026-105483)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Node.js TLS ホスト名検証の欠陥により、ホストが全角の数字(.0.0.1)などの非 ASCII 文字で書かれた場合に、一致する IP アドレスがない証明書 SAN が、IPv4 アドレスへの接続を認証する可能性があります。tls.checkServerIdentity() は、正規化して通常の IPv4 アドレスに解決しても、このようなホストを IP アドレスとして認識せず、代わりに証明書の DNS 名および共通名と照合しました。このため、DNS:127.0.0.1 または DNS:*.0.0.1 を含む証明書が、発行されていない IP エンドポイントに対して受け入れられる可能性があります。これは、 CVE-2026-48618 の修正後に導入された回帰です。この脆弱性は、Node.js 26.x および 24.xに影響します。この脆弱性を報告してくれた Hasan Flayyih Abdullah 氏、および修正してくれた jasnell 氏に感謝の意を表します。(CVE-2026-105483)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The version of Node.js installed on the remote host is 24.x prior to 24.22.1 or 26.x prior to 26.12.1. It is, therefore, affected by a TLS certificate hostname bypass vulnerability as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - TLS certificate hostname verification can be bypassed when the IP address is written using fullwidth     digits. (CVE-2026-105483)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to     authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as     fullwidth digits (`.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,     even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate     DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could     therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the     fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
370489	Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS憑證主機名稱繞過	Nessus	Misc.	2026/10/22	2026/10/23	high
370554	Linux Distros 未修補弱點：CVE-2026-105483	Nessus	Misc.	2026/10/22	2026/10/23	high
370489	Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS 证书主机名绕过	Nessus	Misc.	2026/10/22	2026/10/23	high
370554	Linux Distros 未修补的漏洞：CVE-2026-105483	Nessus	Misc.	2026/10/22	2026/10/23	high
370489	Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS 証明書のホスト名バイパス	Nessus	Misc.	2026/10/22	2026/10/23	high
370554	Linux Distros のパッチ未適用の脆弱性: CVE-2026-105483	Nessus	Misc.	2026/10/22	2026/10/23	high
370489	Node.js 24.x < 24.22.1 / 26.x < 26.12.1 TLS Certificate Hostname Bypass	Nessus	Misc.	2026/10/22	2026/10/23	high
370554	Linux Distros Unpatched Vulnerability : CVE-2026-105483	Nessus	Misc.	2026/10/22	2026/10/23	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high