A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the
    client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**,
    **Node.js 24**, and **Node.js 26**. (CVE-2026-48931)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4809 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4809-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 01, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nodejs     Version        : 18.20.4+dfsg-1~deb12u3     CVE ID         : CVE-2026-48618 CVE-2026-48928 CVE-2026-48930 CVE-2026-48931                      CVE-2026-48933 CVE-2026-48934 CVE-2026-56846 CVE-2026-56848                      CVE-2026-56850 CVE-2026-58040 CVE-2026-58042

    Multiple vulnerabilities were discovered in Node.js, which could result     in denial of service, incorrect certificate     validation or information disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     18.20.4+dfsg-1~deb12u3.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6517 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6517-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 26, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nodejs     CVE ID         : CVE-2026-48617 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928                      CVE-2026-48930 CVE-2026-48931 CVE-2026-48933 CVE-2026-48934                      CVE-2026-48935 CVE-2026-48937 CVE-2026-56846 CVE-2026-56847                      CVE-2026-56848 CVE-2026-56850 CVE-2026-58039

    Multiple vulnerabilities were discovered in Node.js, which could result     in denial of service, permission model bypass, incorrect certificate     validation or information disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 20.19.2+dfsg-1+deb13u3.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4261-1 advisory.

    - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a     multipart/form-data request       (bsc#1236258).
    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous       operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error       (bsc#1256573).
    - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is     enabled can       lead to crash (bsc#1256574).
    - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using     it as the       Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
    - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
    - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes     (bsc#1273591).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource       exhaustion (bsc#1256848).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

    Changes for nodejs18:

    - upgraded embedded undici to 6.28.0.
    - upgraded embedded nghttp2 to 1.69.0.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4248-1 advisory.

    - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a     multipart/form-data request       (bsc#1236258).
    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous       operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error       (bsc#1256573).
    - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is     enabled can       lead to crash (bsc#1256574).
    - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using     it as the       Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
    - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
    - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes     (bsc#1273591).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource       exhaustion (bsc#1256848).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

    Changes for nodejs18:

    - upgraded embedded undici to 6.28.0.
    - upgraded embedded nghttp2 to 1.69.0.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1921 advisory.

    When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax,     or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec     values are silently mapped to one of the three standard tokens:

    SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.SameSite=StrictLax is parsed as     Lax, a downgrade from Strict.Affected applications are those that consume Set-Cookie headers from server     responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed     sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's     SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to     provide.

    This was introduced in undici 5.15.0 when the cookies feature was added. (CVE-2026-11525)

    SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension     that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying     a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in     fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in     fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an     FTS5 MATCH query is executed against the malicious database. (CVE-2026-11822)

    SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search     extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database     with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger     an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH     query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled     with SQLITE_ENABLE_FTS5. (CVE-2026-11824)

    The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message     but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many     small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively     causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of     service.

    Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the     WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket     endpoint.

    All releases starting at undici 6.17.0 are affected. (CVE-2026-12151)

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages.

    When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and     captured by logs, diagnostics, or other error consumers.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48615)

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path     Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under     affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js     24**, and **Node.js 26**. (CVE-2026-48617)

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48618)

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could     lead to an Out of Memory error on the client.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48619)

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48928)

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority     rebinding due to c-string truncation in resolver bindings.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48930)

    A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the     client has sent the request.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48931)

    A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48933)

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48934)

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as     read-only with e.g. --allow-fs-read.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48935)

    A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY`     frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
    (CVE-2026-48937)

    Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An     attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after     a request completes. When the client dispatches the next request on that socket, it associates the     injected response with the new request, causing responses to be delivered to the wrong requests.

    This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection     reuse. (CVE-2026-6733)

    undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded     sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 SS5.4 does not     specify any decoding and browsers do not decode either.

    Applications that parse a Set-Cookie header and then forward the parsed value into a response header     (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-     controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the     application's downstream response, enabling session fixation, open redirect, or cache poisoning.

    Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie,     getSetCookies) and forward the parsed cookie value into a response header.

    This was introduced in undici 7.0.0 (CVE-2026-9679)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1920 advisory.

    When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax,     or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec     values are silently mapped to one of the three standard tokens:

    SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.SameSite=StrictLax is parsed as     Lax, a downgrade from Strict.Affected applications are those that consume Set-Cookie headers from server     responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed     sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's     SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to     provide.

    This was introduced in undici 5.15.0 when the cookies feature was added. (CVE-2026-11525)

    SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension     that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying     a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in     fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in     fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an     FTS5 MATCH query is executed against the malicious database. (CVE-2026-11822)

    SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search     extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database     with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger     an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH     query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled     with SQLITE_ENABLE_FTS5. (CVE-2026-11824)

    The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message     but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many     small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively     causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of     service.

    Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the     WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket     endpoint.

    All releases starting at undici 6.17.0 are affected. (CVE-2026-12151)

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages.

    When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and     captured by logs, diagnostics, or other error consumers.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48615)

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path     Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under     affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js     24**, and **Node.js 26**. (CVE-2026-48617)

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48618)

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could     lead to an Out of Memory error on the client.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48619)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the     preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to     bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking     the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
    (CVE-2026-48758)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the     documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before     verification, so required certificate extension OIDs are never checked and applications relying on     certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates.
    This issue is fixed in version 4.1.1. (CVE-2026-48815)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1,     @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2     inclusionProof-only entries even though the inclusion proof path does not cryptographically bind     integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity     and timestampThreshold verification decisions. This issue is fixed in version 3.1.1. (CVE-2026-48816)

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48928)

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority     rebinding due to c-string truncation in resolver bindings.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48930)

    A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the     client has sent the request.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48931)

    A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48933)

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48934)

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as     read-only with e.g. --allow-fs-read.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48935)

    A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY`     frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
    (CVE-2026-48937)

    Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An     attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after     a request completes. When the client dispatches the next request on that socket, it associates the     injected response with the new request, causing responses to be delivered to the wrong requests.

    This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection     reuse. (CVE-2026-6733)

    When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without     verifying that the pool's origin matches the requested origin. All requests are dispatched through the     pool connected to the first origin, regardless of the intended destination.

    This causes cross-origin request routing: credentials and request data intended for origin B are sent to     origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to     HTTP.

    Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make     requests to more than one origin.

    This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0. (CVE-2026-6734)

    Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-     Control header uses whitespace-padded qualified private or no-cache field names such as private=     authorization or no-cache=\tauthorization. The parser preserves the surrounding whitespace, so later     comparisons against the literal authorization field name fail and the response is stored.

    In shared-cache mode, this allows a response containing one user's authenticated data to be served from     cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same     cache key.

    Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in     shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical     qualified private or no-cache directives. (CVE-2026-9678)

    undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded     sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 SS5.4 does not     specify any decoding and browsers do not decode either.

    Applications that parse a Set-Cookie header and then forward the parsed value into a response header     (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-     controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the     application's downstream response, enabling session fixation, open redirect, or cache poisoning.

    Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie,     getSetCookies) and forward the parsed cookie value into a response header.

    This was introduced in undici 7.0.0 (CVE-2026-9679)

    undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI     (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's     default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

    Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is     SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-     trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and     tamper of the HTTPS exchange.

    Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5     AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5     support was added. (CVE-2026-9697)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2695-1 advisory.

    - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
    - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
    - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
    - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
    - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
    - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
    - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
    - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
    - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
    - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
    - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery ( bsc#1268479).
    - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding (     bsc#1268477).
    - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie     header (bsc#1268481).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec` ( bsc#1266318).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21058-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 22.23.0, 24.17.0, or 26.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Thursday, June 18, 2026 Security Releases advisory.

  - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB. (CVE-2026-48933)

  - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
    (CVE-2026-48618)

  - A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling     paths and captured by logs, diagnostics, or other error consumers. (CVE-2026-48615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority
    rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported
    release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48930)

  - A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error
    messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling
    paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all
    supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48615)

  - A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path
    Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under
    affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js
    24**, and **Node.js 26**. (CVE-2026-48617)

  - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls
    wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can
    lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**. (CVE-2026-48618)

  - A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could
    lead to an Out of Memory error on the client. This vulnerability affects all supported release lines:
    **Node.js 22**, **Node.js 24**, and **Node.js 26**. (CVE-2026-48619)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the     client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**,
    **Node.js 24**, and **Node.js 26**. (CVE-2026-48931)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465320	Echo: nodejs: security update to 20.19.2+dfsg-1+deb13u3	Tenable Cloud Security	Echo Local Security Checks	Local	low
465320	Echo: nodejs: security update to 20.19.2+dfsg-1+deb13u3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362454	Debian dla-4809 : libnode-dev - security update	Nessus	Debian Local Security Checks	Local	critical
350783	Debian dsa-6517 : libnode-dev - security update	Nessus	Debian Local Security Checks	Local	critical
348277	SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2026:4261-1)	Nessus	SuSE Local Security Checks	Local	critical
347901	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2026:4248-1)	Nessus	SuSE Local Security Checks	Local	critical
332479	Photon OS 5.0: Nodejs PHSA-2026-5.0-91-0895	Nessus	PhotonOS Local Security Checks	Local	high
327401	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1921)	Nessus	Amazon Linux Local Security Checks	Local	high
327374	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1920)	Nessus	Amazon Linux Local Security Checks	Local	high
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	Local	high
324854	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2695-1)	Nessus	SuSE Local Security Checks	Local	high
324066	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21058-1)	Nessus	SuSE Local Security Checks	Local	high
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	Local	high
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	Local	high
322945	Photon OS 5.0: Nodejs PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high
322793	Node.js 22.x < 22.23.0 / 24.x < 24.17.0 / 26.x < 26.3.1 Multiple Vulnerabilities (Thursday, June 18, 2026 Security Releases).	Nessus	Misc.	Local	critical
443757	Alpine: multiple nodejs packages: security update to 24.17.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
443757	Alpine: multiple nodejs packages: security update to 24.17.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
443746	Alpine: nodejs: security update to 22.23.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
443746	Alpine: nodejs: security update to 22.23.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
321741	Linux Distros Unpatched Vulnerability : CVE-2026-48931	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-48931

low

Tenable Plugins

low

low

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

low