A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

oracle_linux ELSA-2026-7350: ELSA-2026-7350:  nodejs:24 security update (IMPORTANT)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1299-1 advisory.

    - Update to 24.14.1
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21712: malformed URL format can lead to a crash (bsc#1260460).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to trivially predictable hash collisions (bsc#1260494).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7670 advisory.

    nodejs     [1:24.14.1-2]
    - Update bundled nghttp2 to 1.68.1       Related: RHEL-151374

    [1:24.14.1-1]
    - Update to 24.14.0       Resolves: RHEL-151374

    nodejs-nodemon     [3.0.3-1]
    - Initial import into nodejs:24 module

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121576

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

    [2021.06-4]
    - NPM bundler: also find namespaced bundled dependencies

    [2021.06-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

    [2021.06-2]
    - Fix hard-coded output directory in the bundler

    [2021.06-1]
    - Update to 2021.06-1
    - bundler: Handle archaic license metadata
    - bundler: Warn about bundled dependencies with no license metadata

    [2021.01-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [2021.01-2]
    - nodejs-packaging-bundler improvements to handle uncommon characters

    [2021.01]
    - Add nodejs-packaging-bundler and update README.md

    [2020.09-1]
    - Move to dist-git as the upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1578 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process.

    This vulnerability affects 24.x and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#assertion-error-in-node_urlcc-     via-malformed-url-format-leads-to-nodejs-crash-cve-2026-21712---medium (CVE-2026-21712)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an     attacker-controlled archive can create a hardlink inside the extraction directory that points to a file     outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is     high because the primitive bypasses path protections and turns archive extraction into a direct filesystem     access primitive. This issue has been fixed in version 7.5.8. (CVE-2026-26960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1577 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1576 advisory.

    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#denial-of-service-via-
    __proto__-header-name-in-reqheadersdistinct-uncaught-typeerror-crashes-nodejs-process-cve-2026-21710---     high (CVE-2026-21710)

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values.

    Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this     is an oversight rather than an intentional design decision.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#timing-side-channel-in-hmac-     verification-via-memcmp-in-crypto_hmaccc-leads-to-potential-mac-forgery-cve-2026-21713---medium     (CVE-2026-21713)

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 231-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

    This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#memory-leak-in-nodejs-     http2-server-via-window_update-on-stream-0-leads-to-resource-exhaustion-cve-2026-21714---medium     (CVE-2026-21714)

    A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the     required read permission checks, while all comparable filesystem functions correctly enforce them. As a     result, code running under --permission with restricted --allow-fs-read can still use     fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths     outside of permitted directories.This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the     Permission Model where --allow-fs-read is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#permission-model-bypass-in-     realpathsyncnative-allows-file-existence-disclosure-cve-2026-21715---low (CVE-2026-21715)

    An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API     without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown())     were correctly patched.

    As a result, code running under --permission with restricted --allow-fs-write can still use promise-based     FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing     the intended write restrictions.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-     fs-write is intentionally restricted.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#cve-2024-36137-patch-bypass---     filehandlechmodchown-cve-2026-21716---low (CVE-2026-21716)

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value,     making hash collisions trivially predictable. By crafting a request that causes many such collisions in     V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

    The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON     parsing automatically internalizes short strings into the affected hash table.

    This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

    NOTE: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases#hashdos-in-v8-cve-2026-21717
    ---medium (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7675 advisory.

    [1:24.14.1-2.0.1]
    - Update upstream references

    [1:24.14.1-2]
    - Update bundled nghttp2 to 1.68.1

    [1:24.14.1-1]
    - Update to version 24.14.1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7675 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7670 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7670 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:7350 advisory.

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7350 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

    * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

    * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate     decompression (CVE-2026-1526)

    * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter     (CVE-2026-2229)

    * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers     (CVE-2026-1525)

    * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing     (CVE-2026-21712)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

    * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read     restrictions (CVE-2026-21715)

    * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership     via incomplete security fix. (CVE-2026-21716)

    * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission     checks (CVE-2026-21711)

    * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

    * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames     (CVE-2026-21714)

    * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash     collisions (CVE-2026-21717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6183 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6183-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 29, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nodejs     CVE ID         : CVE-2026-21637 CVE-2026-21710 CVE-2026-21713 CVE-2026-21714                      CVE-2026-21715 CVE-2026-21716 CVE-2026-21717

    Multiple vulnerabilities were discovered in Node.js, which could result     in denial of service, side channel attacks or information disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 20.19.2+dfsg-1+deb13u2.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0     (connection-level) that cause the flow control window to exceed the maximum value of 2-1. The server     correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability     affects HTTP2 users on Node.js 20, 22, 24 and 25. (CVE-2026-21714)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 20.20.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, March 24, 2026 Security Releases advisory.

  - A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server     when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks     bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process     termination or silent file descriptor leaks that eventually lead to denial of service. Because these     callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly     trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js     versions where these callbacks throw without being safely wrapped. (CVE-2026-21637)

  - A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however,     operations such as fs.fchown or fs.fchmod can use a read-only file descriptor to change the owner and     permissions of a file. (CVE-2024-36137)

  - A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct. When this occurs,     dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to be called on a     non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by     error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a     try/catch. Thank you, to yushengchen for reporting this vulnerability and thank you mcollina for fixing     it. (CVE-2026-21710)

  - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations     without the required permission checks, while all comparable network paths correctly enforce them. As a     result, code running under --permission without --allow-net can create and expose local IPC endpoints,     allowing communication with other processes on the same host outside of the intended network restriction     boundary. Thank you, to xavlimsg for reporting this vulnerability and thank you RafaelGSS for fixing it.
    (CVE-2026-21711)

  - A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process. Thank you, to wooffie for reporting this vulnerability and thank you RafaelGSS for fixing it.
    (CVE-2026-21712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
306328	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:1299-1)	Nessus	SuSE Local Security Checks	high
306250	Oracle Linux 8 : nodejs:24 (ELSA-2026-7670)	Nessus	Oracle Linux Local Security Checks	high
306235	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1578)	Nessus	Amazon Linux Local Security Checks	high
306226	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2026-1577)	Nessus	Amazon Linux Local Security Checks	medium
306217	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1576)	Nessus	Amazon Linux Local Security Checks	medium
306167	Oracle Linux 10 : nodejs24 (ELSA-2026-7675)	Nessus	Oracle Linux Local Security Checks	critical
306067	RHEL 10 : nodejs24 (RHSA-2026:7675)	Nessus	Red Hat Local Security Checks	critical
306066	RHEL 8 : nodejs:24 (RHSA-2026:7670)	Nessus	Red Hat Local Security Checks	high
306061	RockyLinux 8 : nodejs:24 (RLSA-2026:7670)	Nessus	Rocky Linux Local Security Checks	high
305993	Photon OS 4.0: Nodejs PHSA-2026-4.0-0995	Nessus	PhotonOS Local Security Checks	medium
305991	Photon OS 5.0: Nodejs PHSA-2026-5.0-0814	Nessus	PhotonOS Local Security Checks	medium
305802	RockyLinux 9 : nodejs:24 (RLSA-2026:7350)	Nessus	Rocky Linux Local Security Checks	critical
305798	RHEL 9 : nodejs:24 (RHSA-2026:7350)	Nessus	Red Hat Local Security Checks	critical
304242	Debian dsa-6183 : libnode-dev - security update	Nessus	Debian Local Security Checks	high
303613	Linux Distros Unpatched Vulnerability : CVE-2026-21714	Nessus	Misc.	medium
303494	Node.js 20.x < 20.20.2 Multiple Vulnerabilities (Tuesday, March 24, 2026 Security Releases).	Nessus	Misc.	high

Detections

Analytics

CVE-2026-21714

medium

Tenable Plugins

Coming Soon

high

high

high

medium

medium

critical

critical

high

high

medium

medium

critical

critical

high

medium

high