pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-69a1acbbc0 advisory.

    Update pnpm to version 10.9.0 to fix CVE-2024-47829 and nodejs-bash-language-server to version 5.6.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-f68a9b835d advisory.

    Update pnpm to version 10.9.0 to fix CVE-2024-47829 and nodejs-bash-language-server to version 5.6.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-d4cc30bdfb advisory.

    Update pnpm to version 10.9.0 to fix CVE-2024-47829 and nodejs-bash-language-server to version 5.6.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as
    a path shortening compression function, and if a collision occurs, it will result in the same storage path
    for two different libraries. Although the real names are under the package name /node_modoules/, there are
    no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.
    (CVE-2024-47829)

ID	Name	Product	Family	Severity
241535	Fedora 42 : nodejs-bash-language-server / nodejs-pnpm (2025-69a1acbbc0)	Nessus	Fedora Local Security Checks	medium
235103	Fedora 40 : nodejs-bash-language-server / nodejs-pnpm (2025-f68a9b835d)	Nessus	Fedora Local Security Checks	medium
235100	Fedora 41 : nodejs-bash-language-server / nodejs-pnpm (2025-d4cc30bdfb)	Nessus	Fedora Local Security Checks	medium
425755	SCA: security update for pnpm (GHSA-8cc4-rfj6-fhg4)	Tenable Cloud Security	SCA Checks	medium
425755	SCA: security update for pnpm (GHSA-8cc4-rfj6-fhg4)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-47829

medium

Tenable Plugins

medium

medium

medium

medium

medium