The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0644-1 advisory.

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  -  Denial of Service by resource exhaustion in fetch() brotli decoding. (CVE-2024-22025)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization     headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been     patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2024-24758)

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3776 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3776-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     March 26, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nodejs     Version        : 10.24.0~dfsg-1~deb10u4     CVE ID         : CVE-2023-30590 CVE-2023-46809 CVE-2024-22025     Debian Bug     : 1039990 1064055

    Vulnerabilities have been found in Node.js, which could lead to denial     of service or information disclosure.

    CVE-2023-30590

        Ben Smyth reported an inconsistency between implementation and         documented design of the The generateKeys() API function, which         only generates missing (or outdated) keys, that is, it only         generates a private key if none has been set yet.
        The documented behavior has been updated to reflect the current         implementation.

    CVE-2023-46809

        It was discovered that Node.js was vulnerable to the Marvin Attack,         allowing a covert timing side-channel during PKCS#1 v1.5 padding         error handling.  An attacker could remotely exploit the         vulnerability to decrypt captured RSA ciphertexts or forge         signatures, especially in scenarios involving API endpoints         processing Json Web Encryption messages.
        The fix disables RSA_PKCS1_PADDING for crypto.privateDecrypt(), and         includes a security revert flag that can be used to restore support         (and the vulnerability).

    CVE-2024-22025

        It was discovered that Node.js was vulnerable to Denial of Service         by resource exhaustion in fetch() brotli decoding.

    For Debian 10 buster, these problems have been fixed in version     10.24.0~dfsg-1~deb10u4.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0731-1 advisory.

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  -  Denial of Service by resource exhaustion in fetch() brotli decoding. (CVE-2024-22025)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization     headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been     patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2024-24758)

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0729-1 advisory.

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - Node.js reports: Code injection and privilege escalation through Linux capabilities- (High) http: Reading     unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) Path traversal by     monkey-patching Buffer internals- (High) setuid() does not drop all privileges due to io_uring - (High)     Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1     v1.5 padding) - (Medium) Multiple permission model bypasses due to improper path traversal sequence     sanitization - (Medium) Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)     Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) (CVE-2024-22025)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization     headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been     patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2024-24758)

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1510 advisory.

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1687 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)

    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)

    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)

    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1687 advisory.

    - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1687 advisory.

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)
    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)
    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)
    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1880 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs:18/nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)

    * nodejs:18/nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding     (Marvin) (CVE-2023-46809)

    * nodejs:18/nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-11 (Node.js: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
191136	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2024:0644-1)	Nessus	SuSE Local Security Checks	2024/2/29	2025/2/13	high
192597	Debian dla-3776 : libnode-dev - security update	Nessus	Debian Local Security Checks	2024/3/27	2025/1/22	high
203744	Photon OS 3.0: Nodejs PHSA-2024-3.0-0738	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/4/3	high
204256	Photon OS 4.0: Nodejs PHSA-2024-4.0-0586	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/2/13	high
191455	SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2024:0731-1)	Nessus	SuSE Local Security Checks	2024/3/1	2024/3/1	high
191641	SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2024:0729-1)	Nessus	SuSE Local Security Checks	2024/3/6	2024/3/6	high
192617	Rocky Linux 8 : nodejs:18 (RLSA-2024:1510)	Nessus	Rocky Linux Local Security Checks	2024/3/27	2025/2/13	high
192973	RHEL 8 : nodejs:20 (RHSA-2024:1687)	Nessus	Red Hat Local Security Checks	2024/4/8	2025/4/3	critical
193028	Oracle Linux 8 : nodejs:20 (ELSA-2024-1687)	Nessus	Oracle Linux Local Security Checks	2024/4/8	2025/9/9	critical
193169	AlmaLinux 8 : nodejs:20 (ALSA-2024:1687)	Nessus	Alma Linux Local Security Checks	2024/4/10	2025/4/3	critical
193473	RHEL 8 : nodejs:18 (RHSA-2024:1880)	Nessus	Red Hat Local Security Checks	2024/4/18	2025/2/13	high
236407	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/5/14	2025/5/17	critical

検出

プラグインの検索

high

high

high

high

high

high

high

critical

critical

critical

high

critical