Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.

oracle CPUJan2026: Business Intelligence Enterprise Edition

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16480 advisory.

  - Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and     1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its     Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200     response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so     an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and     crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a     patch for the issue. (CVE-2025-58754)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The detected versions of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing     absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends     the request to the specified absolute URL, potentially causing SSRF and credential leakage.     This issue impacts both server-side and client-side usage of axios. (CVE-2025-27152)

  - Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0     and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does     not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and     returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect     HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded     memory and crash (DoS), even if the caller requested `responseType: 'stream'` (CVE-2025-58754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23069 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django SQL injection (CVE-2025-64459)
    * python3.11-django: Django SQL injection (CVE-2025-64459)
    * automation-eda-controller: Sensitive Internal Headers Disclosure in AAP EDA Event Streams     (CVE-2025-9908)
    * automation-eda-controller: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA (CVE-2025-9907)
    * automation-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration (CVE-2025-9909)
    * automation-gateway: Axios DoS via lack of data size check (CVE-2025-58754)
    * receptor: quic-go Crash Due to Premature HANDSHAKE_DONE Frame (CVE-2025-59530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed using and condition with multiple attributes. Where previously the authentication map would skip     the missing attributes, with this fix the the map will be applied only if all attributes are present and     the condition(s) are met (AAP-53523)
    * Added UI changes to subscription management splash page (AAP-47864)
    * Fixed an issue where job templates did not remain editable after associated project was deleted     (AAP-58474)
    * automation-gateway has been updated to 2.5.20251210
    * python3.11-django-ansible-base has been updated to 2.5.20251210

    Automation Controller
    * Fixed an issue where jobs failed on fapolicyd enabled systems where python 3.9 was not installed by     default (AAP-58479)
    * Fixed an issue in receptor where some edge cases caused JSON to fail to parse (AAP-57253)
    * Fixed GitHub App Installation Access Token Lookup to accept Iv2 Client IDs (AAP-58882)
    * Updated controller to now use the force flag when syncing a project which has 'Allow branch override'     enabled (AAP-58532)
    * Fixed Redis broken pipe error in long-running jobs (AAP-59727)
    * Fixed column main_unifiedjobtemplate.org_unique does not exist migration error (AAP-56221)
    * ansible-runner has been updated to 2.4.2
    * automation-controller has been updated to 4.6.23
    * automation-controller-fapolicyd has been updated to 1.0-5
    * receptor has been updated to 1.6.2

    Automation Hub
    * Autocomplete attribute added to the Automation Hub API password field (AAP-59912)
    * automation-hub has been updated to 4.10.10
    * python3.11-galaxy-ng has been updated to 4.10.10
    * python3.11-galaxy-importer has been updated to 0.4.36

    Event-Driven Ansible
    * Added a credential type for mTLS event stream (AAP-55786)
    * Fixed an issue where redis_tls does not support boolean values such as yes/no (AAP-52828)
    * automation-eda-controller has been updated to 1.1.14

    Container-based Ansible Automation Platform
    * Fixed podman 5.6 compatibility with automation controller container configuration (AAP-58546)
    * Removed EVENT_STREAM_MTLS_BASE_URL from EDA settings file avoiding duplicate entry when using     eda_extra_settings variable (AAP-57587)
    * RHEL minimum version has been updated to 9.4 (AAP-56386)
    * nginx has been updated to 1.24 (AAP-56203)
    * Containerized installer setup has been updated to 2.5-21

    RPM-based Ansible Automation Platform
    * Fixed an issue where the installer failed during execution environment image upload when there is no     automation hub node in inventory (AAP-57122)
    * RHEL minimum version has been updated to 8.10 and 9.4 (AAP-56386)
    * nginx has been updated to 1.24 (AAP-56205)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-20

    Additional changes
    * ansible-builder has been updated to 3.1.1
    * ansible-creator has been updated to 25.12.0
    * ansible-dev-environment has been updated to 25.12.2
    * ansible-dev-tools has been updated to 25.12.0
    * ansible-lint has been updated to 25.12.0
    * ansible-navigator has been updated to 25.12.0
    * ansible-sign has been updated to 0.1.4
    * bindep has been updated to 2.13.0
    * molecule has been updated to 25.12.0
    * python3.11-ansible-compat has been updated to 25.12.0
    * python3.11-distlib has been updated to 0.4.0
    * python3.11-django has been updated to 4.2.26
    * python3.11-execnet has been updated to 2.1.2
    * python3.11-gunicorn has been updated to 23.0.0
    * python3.11-pluggy has been updated to 1.6.0
    * python3.11-pytest has been updated to 9.0.1
    * python3.11-pytest-ansible has been updated to 25.12.0
    * python3.11-pytest-xdist has been updated to 3.8.0
    * python3.11-ruamel-yaml-clib has been updated to 0.2.15
    * python3.11-subprocess-tee has been updated to 0.4.2
    * python3.11-tox-ansible has been updated to 25.12.0
    * python3.11-typing-extensions has been updated to 4.15.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0747 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-58754:
    Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.11.0 runs     on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http     adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
    This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker     can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS),     even if the caller requested `responseType: 'stream'`. Version 1.11.0 contains a patch for the issue.

    CVE-2025-4673:
    Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking     sensitive information.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0     and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it     does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory     (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` /     `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI     and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested     `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue. (CVE-2025-58754)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298249	Atlassian Jira Service Management Data Center and Server 10.3.0 < 10.3.13 / 11.0.x < 11.2.1 / 11.3.0 (JSDSERVER-16480)	Nessus	Misc.	high
294986	Oracle GoldenGate (January 2026 CPU)	Nessus	Misc.	high
278146	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:23069)	Nessus	Red Hat Local Security Checks	critical
275976	TencentOS Server 4: grafana (TSSA-2025:0747)	Nessus	Tencent Local Security Checks	medium
264701	Linux Distros Unpatched Vulnerability : CVE-2025-58754	Nessus	Misc.	high

Detections

Analytics

CVE-2025-58754

high

Tenable Plugins

Coming Soon

high

high

critical

medium

high