A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2059 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits     exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who     passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and     event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the     recursion work. (CVE-2026-13149)

    undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to     before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive,     such as private set to an empty value, can be stored in the default shared cache and later served to a     different caller with the same cache key, disclosing private response bodies and headers including Set-     Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified     one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending     on the consumer's error handling, can terminate the process. Both issues affect applications using the     cache interceptor in shared mode, including the default configuration. The issues are fixed in undici     7.29.0 and 8.9.0. (CVE-2026-13697)

    undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-     cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to     before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters,     so the cache decision fails to recognize the qualification and the response is stored. In shared-cache     mode, this lets a response containing one user's authenticated data be served from cache to a later     caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects     applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and     receive cacheable responses with qualified directives padded with whitespace around the equals sign. This     is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed     in undici 7.29.0 and 8.9.0. (CVE-2026-14643)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the     Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,     and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,     stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject     CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the     upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is     unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from     user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and     CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length     header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,     from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can     return a partial response with a mismatched framing header, close the socket early, and have the retry     interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as     proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to     downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the     retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder     that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and     8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0     up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and     entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie     attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and     an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications     that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope     session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,     HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-16729)

    node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended     header's size= record (and other PAX overrides) to the next header entry of any type, including     intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX     extended header (x) describes the next file entry, not the intermediary extension headers that may sit     between the x header and the file it annotates. Because node-tar lets the PAX size override the byte     length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to     every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed     tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single     crafted archive yields a different set of members under node-tar than under the reference tar tools. An     attacker can use this to hide a member from one parser while it is visible to another, which defeats     security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner     that lists entries with one library while a downstream step extracts with another) This vulnerability is     fixed in 7.5.16. (CVE-2026-53655)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace     Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security     boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client     certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname     verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects     Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodesqlite-sqltagstore-     iterator-replay-can-re-execute-writes-cve-2026-58041---medium (CVE-2026-58041)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than     256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling     to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects     Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-     can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-     on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit     PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as     normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version     7.5.18. (CVE-2026-59871)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a     checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make     no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL     bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach     fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version     7.5.17. (CVE-2026-59875)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits     exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who     passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and     event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the     recursion work. (CVE-2026-13149)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the     Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,     and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,     stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject     CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the     upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is     unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from     user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and     CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length     header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,     from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can     return a partial response with a mismatched framing header, close the socket early, and have the retry     interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as     proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to     downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the     retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder     that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and     8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0     up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and     entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie     attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and     an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications     that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope     session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,     HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-16729)

    A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before     check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial     of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches     sqlite3_value_type() with a NULL sqlite3_value pointer. (CVE-2026-50812)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace     Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security     boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client     certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname     verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects     Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than     256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling     to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects     Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-     can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-     on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a     checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make     no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha     function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value     that triggers the function's regex replacement and string-manipulation logic,  causing excessive CPU     consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23131-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21545-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory.

    Update to 24.18.1.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58041: `node:sqlite` `SQLTagStore` iterator replay can re-execute writes (bsc#1272946).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

    Other updates and bugfixes:

    - Version 24.18.0:
      * fix: severe regression in security update 24.17 of nodejs24 (bsc#1269825)
      * doc: update blockList stability status to release candidate
      * fs: support caller-supplied readFile() buffers
      * http: close pre-request sockets in closeIdleConnections
      * loader: implement package maps
      * net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
      * tls: add certificateCompression option
      * vfs: dispatch node:fs/promises to mounted VFS instances
      * vfs: add minimal node:vfs subsystem

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix
    boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary
    handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability
    affects Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

  - A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and
    enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
    (CVE-2026-56846)

  - A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace
    Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended
    security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**,
    and **26.x**. (CVE-2026-56847)

  - A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while
    `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects
    Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56848)

  - A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual
    TLS (mTLS) client identities to be reused across requests configured with different client certificates.
    This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies     that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to     a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from     `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers     internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the     request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**,
    **Node.js 24**, and **Node.js 26**. (CVE-2026-58044)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is prior to 22.23.2, 24.18.1, 26.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, July 29, 2026 Security Releases advisory.

  - A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the     synchronous node:zlib APIs, causing the process to crash. Repeated exploitation of this condition can     result in a denial of service. Impact: Thank you, to byvini for reporting this vulnerability and thank you     RafaelGSS for fixing it. (CVE-2026-58045)

  - A flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory limits and cause     remote memory exhaustion. Impact: Thank you, to leduckhuong for reporting this vulnerability and thank you     mcollina for fixing it. (CVE-2026-56846)

  - A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. Impact: Thank you, to     hahahkim for reporting this vulnerability and thank you mcollina for fixing it. (CVE-2026-56848)

  - A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries. Under --permission, an attacker who is granted access to one path can abuse radix-tree prefix     boundary handling to read from or write to paths outside the intended filesystem allowlist. Impact: Thank     you, to sy2n0 for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2026-58043)

  - A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client certificates.
    Impact: Thank you, to yottt for reporting this vulnerability and thank you RafaelGSS for fixing it.
    (CVE-2026-56850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
337228	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)	Nessus	Amazon Linux Local Security Checks	Local	critical
337205	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	Nessus	Amazon Linux Local Security Checks	Local	critical
335502	SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)	Nessus	SuSE Local Security Checks	Local	medium
335490	SUSE SLES16 Security Update : nodejs24 (SUSE-SU-2026:23131-1)	Nessus	SuSE Local Security Checks	Local	medium
335109	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21545-1)	Nessus	SuSE Local Security Checks	Local	medium
335045	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)	Nessus	SuSE Local Security Checks	Local	medium
334718	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)	Nessus	SuSE Local Security Checks	Local	medium
333281	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)	Nessus	SuSE Local Security Checks	Local	medium
333280	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)	Nessus	SuSE Local Security Checks	Local	medium
333039	Photon OS 5.0: Nodejs PHSA-2026-5.0-92-0942	Nessus	PhotonOS Local Security Checks	Local	high
445481	Alpine: multiple nodejs packages: security update to 22.23.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
445481	Alpine: multiple nodejs packages: security update to 22.23.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
445480	Alpine: multiple nodejs packages: security update to 24.18.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
445480	Alpine: multiple nodejs packages: security update to 24.18.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
330992	Linux Distros Unpatched Vulnerability : CVE-2026-58044	Nessus	Misc.	Local	low
330668	Node.js 22.x < 22.23.2 / 24.x < 24.18.1 / 26.x < 26.5.1 Multiple Vulnerabilities (Wednesday, July 29, 2026 Security Releases).	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-58044

low

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

low

high