The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23131-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62416 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation     (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:97855 advisory.

    * nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation     (CVE-2026-48617)

    * nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Local server can be started without network permission via Permission API flaw     (CVE-2026-48936)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    * undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives     (CVE-2026-13697)

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)

    * nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions     (CVE-2026-56847)

    * nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw     (CVE-2026-56850)

    * nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)

    * nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)

    * nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)

    * nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator     (CVE-2026-58041)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation     (CVE-2026-85152)

    * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options     (CVE-2026-84961)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61386 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62219 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61376 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64817 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation     (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62219 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788430709 advisory.

  - A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and     enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
    (CVE-2026-56846)

  - A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while     `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects     Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1141 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-56846:
    A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and     enable remote memory exhaustion.

    This vulnerability affects Node.js **24.x** and **22.x**.

    CVE-2026-56848:
    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free.

    This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

    CVE-2026-58043:
    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.

    Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from     or write to paths outside the intended filesystem allowlist.

    This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4261-1 advisory.

    - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a     multipart/form-data request       (bsc#1236258).
    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous       operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error       (bsc#1256573).
    - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is     enabled can       lead to crash (bsc#1256574).
    - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using     it as the       Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
    - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
    - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes     (bsc#1273591).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource       exhaustion (bsc#1256848).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

    Changes for nodejs18:

    - upgraded embedded undici to 6.28.0.
    - upgraded embedded nghttp2 to 1.69.0.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
335490	SUSE SLES16 Security Update : nodejs24 (SUSE-SU-2026:23131-1)	Nessus	SuSE Local Security Checks	2026/8/15	2026/8/26	medium
342432	RHEL 9 : nodejs:22 (RHSA-2026:62416)	Nessus	Red Hat Local Security Checks	2026/9/2	2026/9/2	high
378898	RockyLinux 9 : nodejs:26 (RLSA-2026:97855)	Nessus	Rocky Linux Local Security Checks	2026/11/11	2026/11/11	critical
341735	RHEL 9 : nodejs:24 (RHSA-2026:61386)	Nessus	Red Hat Local Security Checks	2026/8/31	2026/8/31	high
342286	RHEL 8 : nodejs:22 (RHSA-2026:62219)	Nessus	Red Hat Local Security Checks	2026/9/2	2026/9/2	high
342512	RockyLinux 10 : nodejs22 (RLSA-2026:61376)	Nessus	Rocky Linux Local Security Checks	2026/9/3	2026/9/3	high
343765	RHEL 10 : nodejs22 (RHSA-2026:64817)	Nessus	Red Hat Local Security Checks	2026/9/8	2026/9/8	high
351452	AlmaLinux 8 : nodejs:22 (ALSA-2026:62219)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/26	high
360140	AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788430709)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
365174	TencentOS Server 3: nodejs:22 (TSSA-2026:1141)	Nessus	Tencent Local Security Checks	2026/10/12	2026/10/12	high
348277	SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2026:4261-1)	Nessus	SuSE Local Security Checks	2026/9/19	2026/9/23	critical

検出

プラグインの検索

medium

high

critical

high

high

high

high

high

high

high

critical