A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

amazon_alas ALAS2023-2026-1920: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1920

amazon_alas ALAS2023-2026-1921: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1921

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2695-1 advisory.

    - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
    - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
    - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
    - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
    - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
    - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
    - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
    - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
    - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
    - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
    - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery ( bsc#1268479).
    - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding (     bsc#1268477).
    - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie     header (bsc#1268481).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec` ( bsc#1266318).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21058-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The version of Node.js installed on the remote host is prior to 22.23.0, 24.17.0, or 26.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Thursday, June 18, 2026 Security Releases advisory.

  - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB. (CVE-2026-48933)

  - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
    (CVE-2026-48618)

  - A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling     paths and captured by logs, diagnostics, or other error consumers. (CVE-2026-48615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority
    rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported
    release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48930)

  - A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error
    messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling
    paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all
    supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48615)

  - A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path
    Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under
    affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js
    24**, and **Node.js 26**. (CVE-2026-48617)

  - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls
    wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can
    lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**. (CVE-2026-48618)

  - A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could
    lead to an Out of Memory error on the client. This vulnerability affects all supported release lines:
    **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48619)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path     Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under     affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js     24**, and **Node.js 26**. (CVE-2026-48617)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	high
324854	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2695-1)	Nessus	SuSE Local Security Checks	high
324066	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21058-1)	Nessus	SuSE Local Security Checks	high
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	high
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	high
322945	Photon OS 5.0: Nodejs PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	low
322793	Node.js 22.x < 22.23.0 / 24.x < 24.17.0 / 26.x < 26.3.1 Multiple Vulnerabilities (Thursday, June 18, 2026 Security Releases).	Nessus	Misc.	critical
322753	Photon OS 4.0: Nodejs PHSA-2026-4.0-1041	Nessus	PhotonOS Local Security Checks	low
443757	Alpine: multiple nodejs packages: security update to 24.17.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
443757	Alpine: multiple nodejs packages: security update to 24.17.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
443746	Alpine: nodejs: security update to 22.23.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
443746	Alpine: nodejs: security update to 22.23.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
321724	Linux Distros Unpatched Vulnerability : CVE-2026-48617	Nessus	Misc.	low

Detections

Analytics

CVE-2026-48617

low

Tenable Plugins

Coming Soon

high

high

high

high

high

low

critical

low

critical

critical

critical

critical

low