ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to     10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before     embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6     constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An     application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or     the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This     vulnerability is fixed in 10.1.1. (CVE-2026-42338)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	high
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	high
314724	Linux Distros Unpatched Vulnerability : CVE-2026-42338	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-42338

medium

Tenable Plugins

high

high

medium