ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62416 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation     (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55603 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0923 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-11822:
    SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension     that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying     a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in     fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in     fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an     FTS5 MATCH query is executed against the malicious database.

    CVE-2026-11824:
    SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search     extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database     with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger     an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH     query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled     with SQLITE_ENABLE_FTS5.

    CVE-2026-14257:
    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()     function limits the number of results with a max option (default 100,000) but does not bound the length of     each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit     while making each result progressively longer, so total memory scales with both count and string length     until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input     ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced     strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can     be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds     accumulated output and intermediate arrays.

    CVE-2026-54272:
    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions     10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6     addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-     use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped     range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched     their own NAT64  labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared     getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native     IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these     checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before     classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification     is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end     reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been     fixed in version 10.2.1.

    CVE-2026-69152:
    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative     intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the     event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions     1.1.18, 2.1.4, 3.0.6, and 5.0.9.

    CVE-2026-69192:
    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to     10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG     URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the     network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports     correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.
    An application that builds a network trust-boundary decision on these checks, for example a filter     intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and     allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of     Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(),     and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-58819 advisory.

    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54371 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55603 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

    * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:58819 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:58819 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1641:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58819 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory.

    - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149       (memory exhaustion via deeply chained brace groups). as well as       CVE-2026-14257 (fixed in 5.0.8).
    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23131-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21545-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58041: `node:sqlite` `SQLTagStore` iterator replay can re-execute writes (bsc#1272946).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

    Other updates and bugfixes:

    - Version 24.18.0:
      * fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
      * doc: update blockList stability status to release candidate
      * fs: support caller-supplied readFile() buffers
      * http: close pre-request sockets in closeIdleConnections
      * loader: implement package maps
      * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
      * tls: add certificateCompression option
      * vfs: dispatch node:fs/promises to mounted VFS instances
      * vfs: add minimal node:vfs subsystem

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions
    10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6
    addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-
    use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped
    range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched
    their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType()
    against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6
    ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so
    a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For
    IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any
    dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability
    additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version
    10.2.1. (CVE-2026-54272)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions     10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6     addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-     use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped     range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched     their own NAT64  labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType()     against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6     ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so     a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For     IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any     dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability     additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version     10.2.1. (CVE-2026-54272)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342432	RHEL 9 : nodejs:22 (RHSA-2026:62416)	Nessus	Red Hat Local Security Checks	Local	high
342184	AlmaLinux 9 : nodejs:24 (ALSA-2026:55603)	Nessus	Alma Linux Local Security Checks	Local	high
341119	TencentOS Server 3: nodejs:24 (TSSA-2026:0923)	Nessus	Tencent Local Security Checks	Local	high
340146	Oracle Linux 10 : nodejs24 (ELSA-2026-58819)	Nessus	Oracle Linux Local Security Checks	Local	high
339535	RockyLinux 8 : nodejs:24 (RLSA-2026:54371)	Nessus	Rocky Linux Local Security Checks	Local	high
339465	RockyLinux 9 : nodejs:24 (RLSA-2026:55603)	Nessus	Rocky Linux Local Security Checks	Local	high
339426	RockyLinux 10 : nodejs24 (RLSA-2026:58819)	Nessus	Rocky Linux Local Security Checks	Local	high
339403	AlmaLinux 10 : nodejs24 (ALSA-2026:58819)	Nessus	Alma Linux Local Security Checks	Local	high
339112	MiracleLinux 9 : nodejs:24 (AXSA:2026-1641:01)	Nessus	Miracle Linux Local Security Checks	Local	high
339077	RHEL 10 : nodejs24 (RHSA-2026:58819)	Nessus	Red Hat Local Security Checks	Local	high
337859	Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)	Nessus	Oracle Linux Local Security Checks	Local	high
337728	MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)	Nessus	Miracle Linux Local Security Checks	Local	high
335747	Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)	Nessus	Oracle Linux Local Security Checks	Local	high
335502	SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)	Nessus	SuSE Local Security Checks	Local	medium
335490	SUSE SLES16 Security Update : nodejs24 (SUSE-SU-2026:23131-1)	Nessus	SuSE Local Security Checks	Local	medium
335109	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21545-1)	Nessus	SuSE Local Security Checks	Local	medium
335045	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)	Nessus	SuSE Local Security Checks	Local	medium
334718	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)	Nessus	SuSE Local Security Checks	Local	medium
333281	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)	Nessus	SuSE Local Security Checks	Local	medium
333280	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)	Nessus	SuSE Local Security Checks	Local	medium
445615	SCA: security update for ip-address (GHSA-22jq-vg5j-6vgg)	Tenable Cloud Security	SCA Checks	Local	medium
445615	SCA: security update for ip-address (GHSA-22jq-vg5j-6vgg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
330380	Linux Distros Unpatched Vulnerability : CVE-2026-54272	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-54272

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium