Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

amazon_alas ALAS2023-2026-1920: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1920

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35891 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-186580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35841 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-186582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins
    without verifying that the pool's origin matches the requested origin. All requests are dispatched through
    the pool connected to the first origin, regardless of the intended destination. This causes cross-origin
    request routing: credentials and request data intended for origin B are sent to origin A, responses from
    the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are
    applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more
    than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
    Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per
    origin, or avoid using Socks5ProxyAgent with multiple origins. (CVE-2026-6734)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins     without verifying that the pool's origin matches the requested origin. All requests are dispatched through     the pool connected to the first origin, regardless of the intended destination. This causes cross-origin     request routing: credentials and request data intended for origin B are sent to origin A, responses from     the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are     applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more     than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
    Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per     origin, or avoid using Socks5ProxyAgent with multiple origins. (CVE-2026-6734)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326260	RockyLinux 10 : nodejs24 (RLSA-2026:35841)	Nessus	Rocky Linux Local Security Checks	medium
325495	AlmaLinux 9 : nodejs:24 (ALSA-2026:35891)	Nessus	Alma Linux Local Security Checks	medium
325300	RHEL 9 : nodejs:24 (RHSA-2026:35891)	Nessus	Red Hat Local Security Checks	medium
325298	RockyLinux 9 : nodejs:24 (RLSA-2026:35891)	Nessus	Rocky Linux Local Security Checks	medium
325263	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	Nessus	Alma Linux Local Security Checks	medium
325167	RHEL 10 : nodejs24 (RHSA-2026:35841)	Nessus	Red Hat Local Security Checks	medium
443608	SCA: security update for undici (GHSA-hm92-r4w5-c3mj)	Tenable Cloud Security	SCA Checks	high
443608	SCA: security update for undici (GHSA-hm92-r4w5-c3mj)	Tenable Self-Hosted Container Security	SCA Checks	high
321553	Linux Distros Unpatched Vulnerability : CVE-2026-6734	Nessus	Misc.	high

Detections

Analytics

CVE-2026-6734

high

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

high

high

high