A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested
    entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive
    whose local header does not match its central directory, either directly or while compacting the archive,
    the validation error is caught but the parsed local header is left cached without a content offset. A
    later content read then returns attacker-controlled bytes from the start of the file instead of rejecting
    the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC.
    A Node.js-based scanner can therefore approve different content from what another ZIP implementation
    extracts from the same archive. This vulnerability affects Node.js **26.x**. (CVE-2026-106070)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3
    through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state
    memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary
    code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries
    between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory.

    Node.js reports:
    dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high)     TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)     TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)     Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)     Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) -     (medium)     Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP     endpoints (CVE-2026-106072) - (medium)     crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so     every process repeats the same values (CVE-2026-106074) - (medium)     Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation     (CVE-2026-106070) - (low)     Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low)     Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low)

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested     entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive     whose local header does not match its central directory, either directly or while compacting the archive,     the validation error is caught but the parsed local header is left cached without a content offset. A     later content read then returns attacker-controlled bytes from the start of the file instead of rejecting     the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC.
    A Node.js-based scanner can therefore approve different content from what another ZIP implementation     extracts from the same archive. This vulnerability affects Node.js **26.x**. (CVE-2026-106070)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP header validation.
    (CVE-2026-106070)

  - A Permission Model filesystem over-grant exists via wildcard radix lookup. (CVE-2026-106071)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
477486	Chainguard: libnode147, multiple nodejs-26 packages: security update to 26.12.1-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
477486	Chainguard: libnode147, multiple nodejs-26 packages: security update to 26.12.1-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
477459	Alpine: nodejs-current: security update to 26.12.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
477459	Alpine: nodejs-current: security update to 26.12.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
371933	FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)	Nessus	FreeBSD Local Security Checks	Local	critical
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
371306	Linux Distros Unpatched Vulnerability : CVE-2026-106070	Nessus	Misc.	Local	low
370488	Node.js 26.x < 26.12.1 Multiple Vulnerabilities	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-106070

low

Tenable Plugins

low

low

critical

critical

critical

high

high

low

low