An update of the nodejs package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1577 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1363-1 advisory.

    Update to version 20.20.2.

    - CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism     allows for       performance degradation via a crafted request (bsc#1260494).
    - CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to     modify file       permissions and ownership on already-open file descriptors (bsc#1260462).
    - CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure     and       filesystem path enumeration via `fs.realpathSync.native()` (bsc#1260482).
    - CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via `WINDOW_UPDATE`     frames sent       on stream 0 (bsc#1260480).
    - CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of     HMAC values and       potential MAC forgery (bsc#1260463).
    - CVE-2026-21710: uncaught `TypeError` when handling HTTP requests allows for a process crash via requests     with a       header named `__proto__` when the application accesses `req.headersDistinct` (bsc#1260455).
    - CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when `pskCallback`     or       `ALPNCallback` are in use (bsc#1256576).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise. (CVE-2025-55130)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

  - Improper access control in Curl allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11:

  - A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write`     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
    This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. (CVE-2025-55130)

  - Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
    (CVE-2026-21262)

  - Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate     privileges over a network. (CVE-2026-26115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7675 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7675 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
305991	Photon OS 5.0: Nodejs PHSA-2026-5.0-0814	Nessus	PhotonOS Local Security Checks	2026/4/11	2026/10/14	medium
306226	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2026-1577)	Nessus	Amazon Linux Local Security Checks	2026/4/13	2026/4/13	medium
306701	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2026:1363-1)	Nessus	SuSE Local Security Checks	2026/4/16	2026/4/16	high
307436	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	2026/4/18	2026/4/20	high
310403	Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)	Nessus	Misc.	2026/4/27	2026/4/28	high
306067	RHEL 10 : nodejs24 (RHSA-2026:7675)	Nessus	Red Hat Local Security Checks	2026/4/13	2026/4/13	critical
306516	AlmaLinux 10 : nodejs24 (ALSA-2026:7675)	Nessus	Alma Linux Local Security Checks	2026/4/15	2026/4/21	critical

検出

プラグインの検索

medium

medium

high

high

high

critical

critical