There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

遠端主機上安裝的 Node.js 版本在 22.x 之前 22.23.4或 24.x24.22.1之前 。26.x26.12.1 因此，它會受到 2026 年 10 月 21 日星期三安全性版本公告中所述多個弱點的影響。

  - Brotli 解碼器中的越界寫入可以允許遠端程式碼執行。（CVE-2026-111497）

  - dns.resolve 會截斷包含 NUL 字元的名稱。（CVE-2026-105482）

  - 當主機鬆散解析為 IP 位址時，可以略過 TLS 憑證主機名稱驗證。
    (CVE-2026-106069)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Node.js權限模型檔案系統強制執行中的缺陷使 fs.realpathSync（） 沒有必要的讀取權限檢查。這是 的不完整修正 CVE-2026-21715，僅涵蓋 fs.realpathSync.native（）。因此，在 --permission restricted --allow-fs-read 下執行的程式碼仍然可以使用 fs.realpathSync（） 來檢查檔案的存在、解析符號連結目標，以及列舉允許目錄之外的檔案系統路徑。此弱點會影響 Node.js 26.x、 24.x和 22.x。感謝 0xoroot 報告此漏洞，並感謝 RafaelGSS 修復它。（CVE-2026-106073）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程主机上安装的 Node.js 版本低于 22.x22.23.4、 24.x24.22.1或26.x26.12.1低于 。因此，如 2026 年 10 月 21 日星期三安全发布公告所述，受到多个漏洞的影响。

  - Brotli 解码器中的越界写入可允许远程代码执行。（CVE-2026-111497）

  - dns.resolve 会截断包含空字符的名称。（CVE-2026-105482）

  - 主机松散解析为 IP 地址时，可绕过 TLS 证书主机名验证。
    (CVE-2026-106069)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Node.js Permission Model 文件系统强制执行中的一个缺陷使 fs.realpathSync（） 没有所需的读取权限检查。这是不完整的 CVE-2026-21715修复，仅涉及 fs.realpathSync.native（）。因此，在 --permission 带有 restricted --allow-fs-read 的情况下运行的代码仍可使用 fs.realpathSync（） 检查文件是否存在、解析符号链接目标，以及枚举允许的目录之外的文件系统路径。此漏洞影响 Node.js 26.x、 和 24.x22.x。感谢 0xoroot 报告此漏洞，并感谢 RafaelGSS 修复此漏洞。（CVE-2026-106073）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされている Node.js のバージョンは、22.23.4 より前の 22.x、24.x より前の 24.22.1、または 26.12.1 より前の 26.x です。したがって、2026年10月21日水曜日のセキュリティリリースアドバイザリに記載されているとおり、複数の脆弱性の影響を受けます。

  - Brotli デコーダーの領域外書き込みにより、リモートコードの実行が許可される可能性があります。(CVE-2026-111497)

  - dns.resolve は、NULL 文字を含む名前を切り捨てます。(CVE-2026-105482)

  - ホストが IP アドレスに緩やかに解決する場合、TLS 証明書のホスト名の検証をバイパスする可能性があります。
    (CVE-2026-106069)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Node.js権限モデルのファイルシステム実施における欠陥により、fs.realpathSync() は必要な読み取り権限チェックを受けずに残ります。これは、fs.realpathSync.native() のみをカバーする、 CVE-2026-21715 の不完全な修正です。その結果、制限された--allow-fs-readで--permission下で実行されているコードは、依然として fs.realpathSync() を使用してファイルの存在をチェックし、シンボリックリンクターゲットを解決し、許可されたディレクトリ外のファイルシステムパスを列挙できます。この脆弱性は、Node.js 26.x、 24.x、 22.xに影響します。この脆弱性を報告してくれた 0xoroot 氏、およびこれを修正してくれた RafaelGSS 氏に感謝の意を表します。(CVE-2026-106073)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - An out-of-bounds write in the Brotli decoder can permit remote code execution. (CVE-2026-111497)

  - dns.resolve truncates names containing a NUL character. (CVE-2026-105482)

  - TLS certificate hostname verification can be bypassed when the host loosely resolves to an IP address.
    (CVE-2026-106069)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required     read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered     `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-     read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate     filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**,     and **22.x**. (CVE-2026-106073)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477149	Alpine: multiple nodejs packages: security update to 22.23.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477149	Alpine: multiple nodejs packages: security update to 22.23.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 多個弱點	Nessus	Misc.	2026/10/22	2026/10/23	critical
370548	Linux Distros 未修補弱點：CVE-2026-106073	Nessus	Misc.	2026/10/22	2026/10/24	low
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 多个漏洞	Nessus	Misc.	2026/10/22	2026/10/23	critical
370548	Linux Distros 未修补的漏洞：CVE-2026-106073	Nessus	Misc.	2026/10/22	2026/10/24	low
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 複数の脆弱性	Nessus	Misc.	2026/10/22	2026/10/23	critical
370548	Linux Distros のパッチ未適用の脆弱性: CVE-2026-106073	Nessus	Misc.	2026/10/22	2026/10/24	low
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities	Nessus	Misc.	2026/10/22	2026/10/23	critical
370548	Linux Distros Unpatched Vulnerability : CVE-2026-106073	Nessus	Misc.	2026/10/22	2026/10/24	low

检测

插件搜索

high

high

high

high

critical

low

critical

low

critical

low

critical

low