The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2235:01 advisory.

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
      * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace     patterns (CVE-2026-102278)
      * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
      * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)
      * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
      * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
      * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
      * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
      * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
      * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
      * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)
      * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
      * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:96088 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * undici: undici: Denial of Service via unhandled stream error on excessive content encodings     (CVE-2026-109869)

    * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

    * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

    * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching     (CVE-2026-109829)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92376 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

    * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

    * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)

    * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

    * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92378 advisory.

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

    * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

    * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)

    * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

    * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
375192	MiracleLinux 8 : nodejs:24 (AXSA:2026-2235:01)	Nessus	Miracle Linux Local Security Checks	2026/11/2	2026/11/6	critical
377688	RHEL 10 : nodejs24 (RHSA-2026:96088)	Nessus	Red Hat Local Security Checks	2026/11/9	2026/11/9	critical
373945	RHEL 8 : nodejs:24 (RHSA-2026:92376)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/11/2	critical
374187	RockyLinux 9 : nodejs:24 (RLSA-2026:92378)	Nessus	Rocky Linux Local Security Checks	2026/10/30	2026/11/6	critical

検出

プラグインの検索

critical

critical

critical

critical