Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

amazon_alas ALAS2023-2026-1920: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1920

amazon_alas ALAS2023-2026-1921: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1921

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35891 advisory.

    nodejs     [1:24.18.0-1]
    - Update to version 24.18.0

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121569

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35892 advisory.

    - Update to version 22.23.1       Resolves: RHEL-186622 RHEL-185998 RHEL-183669       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35842 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35892 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35892 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-186622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35891 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-186580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35892 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35842 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35842 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:RHEL-186623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35841 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-186582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2695-1 advisory.

    - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
    - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
    - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
    - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
    - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
    - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
    - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
    - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
    - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
    - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
    - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery ( bsc#1268479).
    - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding (     bsc#1268477).
    - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie     header (bsc#1268481).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec` ( bsc#1266318).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21058-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains     Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.
    Non-spec values are silently mapped to one of the three standard tokens. For example,     SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is     parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers     from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the     parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a     cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is     supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches:
    Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate     that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive)     before forwarding or relying on it. (CVE-2026-11525)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains
    Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.
    Non-spec values are silently mapped to one of the three standard tokens. For example,
    SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is
    parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers
    from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the
    parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a
    cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is
    supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches:
    Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate
    that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive)
    before forwarding or relying on it. (CVE-2026-11525)

ID	Name	Product	Family	Severity
326382	Oracle Linux 9 : nodejs:24 (ELSA-2026-35891)	Nessus	Oracle Linux Local Security Checks	medium
326260	RockyLinux 10 : nodejs24 (RLSA-2026:35841)	Nessus	Rocky Linux Local Security Checks	medium
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	high
325788	Oracle Linux 9 : nodejs:22 (ELSA-2026-35892)	Nessus	Oracle Linux Local Security Checks	medium
325656	RockyLinux 10 : nodejs22 (RLSA-2026:35842)	Nessus	Rocky Linux Local Security Checks	medium
325502	AlmaLinux 9 : nodejs:22 (ALSA-2026:35892)	Nessus	Alma Linux Local Security Checks	medium
325495	AlmaLinux 9 : nodejs:24 (ALSA-2026:35891)	Nessus	Alma Linux Local Security Checks	medium
325303	RHEL 9 : nodejs:22 (RHSA-2026:35892)	Nessus	Red Hat Local Security Checks	medium
325300	RHEL 9 : nodejs:24 (RHSA-2026:35891)	Nessus	Red Hat Local Security Checks	medium
325298	RockyLinux 9 : nodejs:24 (RLSA-2026:35891)	Nessus	Rocky Linux Local Security Checks	medium
325297	RockyLinux 9 : nodejs:22 (RLSA-2026:35892)	Nessus	Rocky Linux Local Security Checks	medium
325285	AlmaLinux 10 : nodejs22 (ALSA-2026:35842)	Nessus	Alma Linux Local Security Checks	medium
325263	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	Nessus	Alma Linux Local Security Checks	medium
325168	RHEL 10 : nodejs22 (RHSA-2026:35842)	Nessus	Red Hat Local Security Checks	medium
325167	RHEL 10 : nodejs24 (RHSA-2026:35841)	Nessus	Red Hat Local Security Checks	medium
324854	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2695-1)	Nessus	SuSE Local Security Checks	high
324066	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21058-1)	Nessus	SuSE Local Security Checks	high
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	high
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	high
321573	Linux Distros Unpatched Vulnerability : CVE-2026-11525	Nessus	Misc.	low
443600	SCA: security update for undici (GHSA-g8m3-5g58-fq7m)	Tenable Cloud Security	SCA Checks	low
443600	SCA: security update for undici (GHSA-g8m3-5g58-fq7m)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-11525

low

Tenable Plugins

Coming Soon

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

low

low

low