A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce5dac2ed8 advisory.

    Update to version 24.18.0


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 22.23.0, 24.17.0, or 26.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Thursday, June 18, 2026 Security Releases advisory.

  - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB. (CVE-2026-48933)

  - A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch.
    (CVE-2026-48618)

  - A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling     paths and captured by logs, diagnostics, or other error consumers. (CVE-2026-48615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even     without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js     26**. (CVE-2026-48936)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
330821	Fedora 44 : nodejs24 (2026-ce5dac2ed8)	Nessus	Fedora Local Security Checks	Local	medium
322793	Node.js 22.x < 22.23.0 / 24.x < 24.17.0 / 26.x < 26.3.1 Multiple Vulnerabilities (Thursday, June 18, 2026 Security Releases).	Nessus	Misc.	Local	critical
321775	Linux Distros Unpatched Vulnerability : CVE-2026-48936	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-48936

low

Tenable Plugins

medium

critical

low