A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-465:01 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-449:01 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7350 advisory.

    nodejs     [1:24.14.1-2]
    - Update bundled nghttp2 to 1.68.1

    [1:24.14.1-1]
    - Update to version 24.14.1

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121581

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7350 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7670 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7675 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:7675 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)
      * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion     (CVE-2026-25547)
      * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
      * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
      * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
      * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)
      * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)
      * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)
      * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
      * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)
      * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)
      * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
      * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)
      * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)
      * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket     permission checks (CVE-2026-21711)
      * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
      * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)
      * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7670 advisory.

    nodejs     [1:24.14.1-2]
    - Update bundled nghttp2 to 1.68.1       Related: RHEL-151374

    [1:24.14.1-1]
    - Update to 24.14.0       Resolves: RHEL-151374

    nodejs-nodemon     [3.0.3-1]
    - Initial import into nodejs:24 module

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121576

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

    [2021.06-4]
    - NPM bundler: also find namespaced bundled dependencies

    [2021.06-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

    [2021.06-2]
    - Fix hard-coded output directory in the bundler

    [2021.06-1]
    - Update to 2021.06-1
    - bundler: Handle archaic license metadata
    - bundler: Warn about bundled dependencies with no license metadata

    [2021.01-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [2021.01-2]
    - nodejs-packaging-bundler improvements to handle uncommon characters

    [2021.01]
    - Add nodejs-packaging-bundler and update README.md

    [2020.09-1]
    - Move to dist-git as the upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7675 advisory.

    [1:24.14.1-2.0.2]
    - Rebuild to correct NVR

    [1:24.14.1-2.0.1]
    - Update upstream references

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7675 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7670 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7670 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7350 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7350 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations     without the required permission checks, while all comparable network paths correctly enforce them. As a     result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints,     allowing communication with other processes on the same host outside of the intended network restriction     boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-     net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an     experimental feature. (CVE-2026-21711)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 20.20.2, 22.22.2, 24.14.1, 25.8.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, March 24, 2026 Security Releases advisory.

  - A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server     when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks     bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process     termination or silent file descriptor leaks that eventually lead to denial of service. Because these     callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly     trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js     versions where these callbacks throw without being safely wrapped. (CVE-2026-21637)

  - A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a     header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs,     `dest[__proto__]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called     on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted     by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct`     access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and     v25.x** (CVE-2026-21710)

  - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations     without the required permission checks, while all comparable network paths correctly enforce them. As a     result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints,     allowing communication with other processes on the same host outside of the intended network restriction     boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-     net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an     experimental feature. (CVE-2026-21711)

  - A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process. (CVE-2026-21712)

  - A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison     primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional     design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. (CVE-2026-21713)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
307486	MiracleLinux 8 : nodejs:24 (AXSA:2026-465:01)	Nessus	Miracle Linux Local Security Checks	Local	high
307262	MiracleLinux 9 : nodejs:24 (AXSA:2026-449:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
307038	Oracle Linux 9 : nodejs:24 (ELSA-2026-7350)	Nessus	Oracle Linux Local Security Checks	Local	critical
306669	AlmaLinux 9 : nodejs:24 (ALSA-2026:7350)	Nessus	Alma Linux Local Security Checks	Local	critical
306667	AlmaLinux 8 : nodejs:24 (ALSA-2026:7670)	Nessus	Alma Linux Local Security Checks	Local	high
306530	RockyLinux 10 : nodejs24 (RLSA-2026:7675)	Nessus	Rocky Linux Local Security Checks	Local	critical
306516	AlmaLinux 10 : nodejs24 (ALSA-2026:7675)	Nessus	Alma Linux Local Security Checks	Local	critical
306250	Oracle Linux 8 : nodejs:24 (ELSA-2026-7670)	Nessus	Oracle Linux Local Security Checks	Local	high
306167	Oracle Linux 10 : nodejs24 (ELSA-2026-7675)	Nessus	Oracle Linux Local Security Checks	Local	critical
306067	RHEL 10 : nodejs24 (RHSA-2026:7675)	Nessus	Red Hat Local Security Checks	Local	critical
306066	RHEL 8 : nodejs:24 (RHSA-2026:7670)	Nessus	Red Hat Local Security Checks	Local	high
306061	RockyLinux 8 : nodejs:24 (RLSA-2026:7670)	Nessus	Rocky Linux Local Security Checks	Local	high
305802	RockyLinux 9 : nodejs:24 (RLSA-2026:7350)	Nessus	Rocky Linux Local Security Checks	Local	critical
305798	RHEL 9 : nodejs:24 (RHSA-2026:7350)	Nessus	Red Hat Local Security Checks	Local	critical
304140	Linux Distros Unpatched Vulnerability : CVE-2026-21711	Nessus	Misc.	Local	medium
303494	Node.js 20.x < 20.20.2 / 22.x < 22.22.2 / 24.x < 24.14.1 / 25.x < 25.8.2 Multiple Vulnerabilities (Tuesday, March 24, 2026 Security Releases).	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-21711

medium

Tenable Plugins

high

critical

critical

critical

high

critical

critical

high

critical

critical

high

high

critical

critical

medium

high