Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0457-1 advisory.

    - Update to 20.20.0:
    - CVE-2026-22036: Updated undici to 6.23.0 (bsc#1256848)
    - CVE-2025-59465: Add TLSSocket default error handler (bsc#1256573)
    - CVE-2025-55132: Disable futimes when permission model is enabled (bsc#1256571)
    - CVE-2025-55130: Require full read and write to symlink APIs (bsc#1256569)
    - CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks (bsc#1256574)
    - CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle (bsc#1256570)
    - CVE-2026-21637: Route callback exceptions through error handlers (bsc#1256576)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0435-1 advisory.

    - Update to 20.20.0:
    - CVE-2026-22036: Updated undici to 6.23.0 (bsc#1256848)
    - CVE-2025-59465: Add TLSSocket default error handler (bsc#1256573)
    - CVE-2025-55132: Disable futimes when permission model is enabled (bsc#1256571)
    - CVE-2025-55130: Require full read and write to symlink APIs (bsc#1256569)
    - CVE-2025-59466: Rethrow stack overflow exceptions in async_hooks (bsc#1256574)
    - CVE-2025-55131: Refactor unsafe buffer creation to remove zero-fill toggle (bsc#1256570)
    - CVE-2026-21637: Route callback exceptions through error handlers (bsc#1256576)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1404 advisory.

    Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption.

    While exploitation typically requires precise timing or in-process code execution, it can become remotely     exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality     and integrity impact. (CVE-2025-55131)

    fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

    Memory leak that enables remote Denial of Service against applications processing TLS client certificates     (CVE-2025-59464)

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

    Uncatchable Maximum call stack size exceeded error on Node.js via async_hooks leads to process crashes     bypassing error handlers (CVE-2025-59466)

    TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

    NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-     exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

    Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the     decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert     thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability     is fixed in 7.18.0 and 6.23.0. (CVE-2026-22036)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8663c5f961 advisory.

    Update to version 22.22.0





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b7ad50870e advisory.

    Update to version 22.22.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb4878551d advisory.

    Update to version 20.20.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cc863e84da advisory.

    Update to version 24.13.0.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f601b2f60a advisory.

    Update to version 20.20.0

    ----

    Update to version 20.19.6




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5cd409edfa advisory.

    Update to version 24.13.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0301-1 advisory.

    Security fixes:

    - CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading       to resource exhaustion (bsc#1256848)
    - CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass       TLS error handling and causing denial of service (bsc#1256576)
    - CVE-2025-55132: Fixed futimes() ability to acces file even if process has read       permissions only (bsc#1256571)
    - CVE-2025-55131: Fixed race condition that allowed allocations with leftover data       leading to in-process secrets exposure (bsc#1256570)
    - CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
    - CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading       to crash (bsc#1256573)
    - CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error       leading to crash (bsc#1256574)

    Other fixes:

    - Update to 22.22.0:
      * deps: updated undici to 6.23.0
      * deps: updated bundled c-ares to 1.34.6 (if used)
      * add TLSSocket default error handler
      * disable futimes when permission model is enabled
      * require full read and write to symlink APIs
      * rethrow stack overflow exceptions in async_hooks
      * refactor unsafe buffer creation to remove zero-fill toggle
      * route callback exceptions through error handlers

    - Update to 22.21.1:
      * src: avoid unnecessary string -> char* -> string round trips
      * src: remove unnecessary shadowed functions on Utf8Value & BufferValue
      * process: fix hrtime fast call signatures
      * http: improve writeEarlyHints by avoiding for-of loop

    - Update to 22.21.0:
      * cli: add --use-env-proxy
      * http: support http proxy for fetch under NODE_USE_ENV_PROXY
      * http: add shouldUpgradeCallback to let servers control HTTP upgrades
      * http,https: add built-in proxy support in http/https.request and Agent
      * src: add percentage support to --max-old-space-size

    - Update to 22.20.0
      * doc: stabilize --disable-sigusr1
      * doc: mark path.matchesGlob as stable
      * http: add Agent.agentKeepAliveTimeoutBuffer option
      * http2: add support for raw header arrays in h2Stream.respond()
      * inspector: add http2 tracking support
      * sea: implement execArgvExtension
      * sea: support execArgv in sea config
      * stream: add brotli support to CompressionStream and DecompressionStream
      * test_runner: support object property mocking
      * worker: add cpu profile APIs for worker

    - Update to 22.19.0
      * cli: add NODE_USE_SYSTEM_CA=1
      * cli: support ${pid} placeholder in --cpu-prof-name
      * crypto: add tls.setDefaultCACertificates()
      * dns: support max timeout
      * doc: update the instruction on how to verify releases
      * esm: unflag --experimental-wasm-modules
      * http: add server.keepAliveTimeoutBuffer option
      * lib: docs deprecate _http_*
      * net: update net.blocklist to allow file save and file management
      * process: add threadCpuUsage
      * zlib: add dictionary support to zstdCompress and zstdDecompress

    - Update to 22.18.0:
      * deps: update amaro to 1.1.0
      * doc: add all watch-mode related flags to node.1
      * doc: add islandryu to collaborators
      * esm: implement import.meta.main
      * fs: allow correct handling of burst in fs-events with AsyncIterator
      * permission: propagate permission model flags on spawn
      * sqlite: add support for readBigInts option in db connection level
      * src,permission: add support to permission.has(addon)
      * url: add fileURLToPathBuffer API
      * watch: add --watch-kill-signal flag
      * worker: make Worker async disposable

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0295-1 advisory.

    Security fixes:

    - CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading       to resource exhaustion (bsc#1256848)
    - CVE-2026-21637: Fixed synchronous exceptions thrown during callbacks that bypass       TLS error handling and causing denial of service (bsc#1256576)
    - CVE-2025-55132: Fixed futimes() ability to acces file even if process has read       permissions only (bsc#1256571)
    - CVE-2025-55131: Fixed race condition that allowed allocations with leftover data       leading to in-process secrets exposure (bsc#1256570)
    - CVE-2025-55130: Fixed filesystem permissions bypass via crafted symlinks (bsc#1256569)
    - CVE-2025-59465: Fixed malformed HTTP/2 HEADERS frame with invalid HPACK leading       to crash (bsc#1256573)
    - CVE-2025-59466: Fixed uncatchable 'Maximum call stack size exceeded' error       leading to crash (bsc#1256574)

    Other fixes:

    - Update to 22.22.0:
      * deps: updated undici to 6.23.0
      * deps: updated bundled c-ares to 1.34.6 (if used)
      * add TLSSocket default error handler
      * disable futimes when permission model is enabled
      * require full read and write to symlink APIs
      * rethrow stack overflow exceptions in async_hooks
      * refactor unsafe buffer creation to remove zero-fill toggle
      * route callback exceptions through error handlers

    - Update to 22.21.1:
      * src: avoid unnecessary string -> char* -> string round trips
      * src: remove unnecessary shadowed functions on Utf8Value & BufferValue
      * process: fix hrtime fast call signatures
      * http: improve writeEarlyHints by avoiding for-of loop

    - Update to 22.21.0:
      * cli: add --use-env-proxy
      * http: support http proxy for fetch under NODE_USE_ENV_PROXY
      * http: add shouldUpgradeCallback to let servers control HTTP upgrades
      * http,https: add built-in proxy support in http/https.request and Agent
      * src: add percentage support to --max-old-space-size

    - Update to 22.20.0
      * doc: stabilize --disable-sigusr1
      * doc: mark path.matchesGlob as stable
      * http: add Agent.agentKeepAliveTimeoutBuffer option
      * http2: add support for raw header arrays in h2Stream.respond()
      * inspector: add http2 tracking support
      * sea: implement execArgvExtension
      * sea: support execArgv in sea config
      * stream: add brotli support to CompressionStream and DecompressionStream
      * test_runner: support object property mocking
      * worker: add cpu profile APIs for worker

    - Update to 22.19.0
      * cli: add NODE_USE_SYSTEM_CA=1
      * cli: support ${pid} placeholder in --cpu-prof-name
      * crypto: add tls.setDefaultCACertificates()
      * dns: support max timeout
      * doc: update the instruction on how to verify releases
      * esm: unflag --experimental-wasm-modules
      * http: add server.keepAliveTimeoutBuffer option
      * lib: docs deprecate _http_*
      * net: update net.blocklist to allow file save and file management
      * process: add threadCpuUsage
      * zlib: add dictionary support to zstdCompress and zstdDecompress

    - Update to 22.18.0:
      * deps: update amaro to 1.1.0
      * doc: add all watch-mode related flags to node.1
      * doc: add islandryu to collaborators
      * esm: implement import.meta.main
      * fs: allow correct handling of burst in fs-events with AsyncIterator
      * permission: propagate permission model flags on spawn
      * sqlite: add support for readBigInts option in db connection level
      * src,permission: add support to permission.has(addon)
      * url: add fileURLToPathBuffer API
      * watch: add --watch-kill-signal flag
      * worker: make Worker async disposable

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the     decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert     thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability     is fixed in 7.18.0 and 6.23.0. (CVE-2026-22036)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298927	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2026:0457-1)	Nessus	SuSE Local Security Checks	medium
298748	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2026:0435-1)	Nessus	SuSE Local Security Checks	medium
298098	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1404)	Nessus	Amazon Linux Local Security Checks	medium
297452	Fedora 43 : nodejs22 (2026-8663c5f961)	Nessus	Fedora Local Security Checks	medium
297446	Fedora 42 : nodejs22 (2026-b7ad50870e)	Nessus	Fedora Local Security Checks	medium
297445	Fedora 42 : nodejs20 (2026-fb4878551d)	Nessus	Fedora Local Security Checks	medium
297444	Fedora 42 : nodejs24 (2026-cc863e84da)	Nessus	Fedora Local Security Checks	medium
297442	Fedora 43 : nodejs20 (2026-f601b2f60a)	Nessus	Fedora Local Security Checks	high
297441	Fedora 43 : nodejs24 (2026-5cd409edfa)	Nessus	Fedora Local Security Checks	medium
297009	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:0301-1)	Nessus	SuSE Local Security Checks	medium
296677	SUSE SLES15 / openSUSE 15 Security Update : nodejs22 (SUSE-SU-2026:0295-1)	Nessus	SuSE Local Security Checks	medium
284705	Linux Distros Unpatched Vulnerability : CVE-2026-22036	Nessus	Misc.	high

Detections

Analytics

CVE-2026-22036

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

high