An update of the nodejs package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6517 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6517-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 26, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nodejs     CVE ID         : CVE-2026-48617 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928                      CVE-2026-48930 CVE-2026-48931 CVE-2026-48933 CVE-2026-48934                      CVE-2026-48935 CVE-2026-48937 CVE-2026-56846 CVE-2026-56847                      CVE-2026-56848 CVE-2026-56850 CVE-2026-58039

    Multiple vulnerabilities were discovered in Node.js, which could result     in denial of service, permission model bypass, incorrect certificate     validation or information disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 20.19.2+dfsg-1+deb13u3.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2695-1 advisory.

    - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
    - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
    - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
    - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
    - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
    - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
    - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
    - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
    - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
    - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
    - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery ( bsc#1268479).
    - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding (     bsc#1268477).
    - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie     header (bsc#1268481).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec` ( bsc#1266318).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
375133	Photon OS 5.0: Nodejs PHSA-2026-5.0-90-1029	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
350783	Debian dsa-6517 : libnode-dev - security update	Nessus	Debian Local Security Checks	2026/9/26	2026/9/26	critical
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	2026/6/27	2026/7/3	high
324854	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2695-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/10/13	high

検出

プラグインの検索

critical

critical

high

high