Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce5dac2ed8 advisory.

    Update to version 24.18.0


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39868 advisory.

    nodejs     [1:24.18.0-1]
    - Update to version 24.18.0       Resolves: RHEL-168744

    nodejs-nodemon     [3.0.3-1]
    - Initial import into nodejs:24 module

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121576

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

    [2021.06-4]
    - NPM bundler: also find namespaced bundled dependencies

    [2021.06-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

    [2021.06-2]
    - Fix hard-coded output directory in the bundler

    [2021.06-1]
    - Update to 2021.06-1
    - bundler: Handle archaic license metadata
    - bundler: Warn about bundled dependencies with no license metadata

    [2021.01-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [2021.01-2]
    - nodejs-packaging-bundler improvements to handle uncommon characters

    [2021.01]
    - Add nodejs-packaging-bundler and update README.md

    [2020.09-1]
    - Move to dist-git as the upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:39868 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-8] (JIRA:AlmaLinux-168744)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1920 advisory.

    When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax,     or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec     values are silently mapped to one of the three standard tokens:

    SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.SameSite=StrictLax is parsed as     Lax, a downgrade from Strict.Affected applications are those that consume Set-Cookie headers from server     responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed     sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's     SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to     provide.

    This was introduced in undici 5.15.0 when the cookies feature was added. (CVE-2026-11525)

    SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension     that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying     a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in     fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in     fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an     FTS5 MATCH query is executed against the malicious database. (CVE-2026-11822)

    SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search     extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database     with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger     an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH     query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled     with SQLITE_ENABLE_FTS5. (CVE-2026-11824)

    The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message     but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many     small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively     causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of     service.

    Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the     WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket     endpoint.

    All releases starting at undici 6.17.0 are affected. (CVE-2026-12151)

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error     messages.

    When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and     captured by logs, diagnostics, or other error consumers.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48615)

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path     Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under     affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js     24**, and **Node.js 26**. (CVE-2026-48617)

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls     wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48618)

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could     lead to an Out of Memory error on the client.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48619)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the     preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to     bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking     the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
    (CVE-2026-48758)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the     documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before     verification, so required certificate extension OIDs are never checked and applications relying on     certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates.
    This issue is fixed in version 4.1.1. (CVE-2026-48815)

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1,     @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2     inclusionProof-only entries even though the inclusion proof path does not cryptographically bind     integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity     and timestampThreshold verification decisions. This issue is fixed in version 3.1.1. (CVE-2026-48816)

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48928)

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority     rebinding due to c-string truncation in resolver bindings.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48930)

    A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the     client has sent the request.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48931)

    A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a     multiple of 2GiB.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48933)

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48934)

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as     read-only with e.g. --allow-fs-read.

    This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
    (CVE-2026-48935)

    A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY`     frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
    (CVE-2026-48937)

    Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An     attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after     a request completes. When the client dispatches the next request on that socket, it associates the     injected response with the new request, causing responses to be delivered to the wrong requests.

    This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection     reuse. (CVE-2026-6733)

    When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without     verifying that the pool's origin matches the requested origin. All requests are dispatched through the     pool connected to the first origin, regardless of the intended destination.

    This causes cross-origin request routing: credentials and request data intended for origin B are sent to     origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to     HTTP.

    Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make     requests to more than one origin.

    This was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0. (CVE-2026-6734)

    Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-     Control header uses whitespace-padded qualified private or no-cache field names such as private=     authorization or no-cache=\tauthorization. The parser preserves the surrounding whitespace, so later     comparisons against the literal authorization field name fail and the response is stored.

    In shared-cache mode, this allows a response containing one user's authenticated data to be served from     cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same     cache key.

    Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in     shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical     qualified private or no-cache directives. (CVE-2026-9678)

    undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded     sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 SS5.4 does not     specify any decoding and browsers do not decode either.

    Applications that parse a Set-Cookie header and then forward the parsed value into a response header     (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-     controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the     application's downstream response, enabling session fixation, open redirect, or cache poisoning.

    Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie,     getSetCookies) and forward the parsed cookie value into a response header.

    This was introduced in undici 7.0.0 (CVE-2026-9679)

    undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI     (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's     default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.

    Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is     SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-     trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and     tamper of the HTTPS exchange.

    Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5     AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5     support was added. (CVE-2026-9697)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39868 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-168744)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39868 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-168744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35891 advisory.

    nodejs     [1:24.18.0-1]
    - Update to version 24.18.0

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121569

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35891 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-186580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35841 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-186582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins
    without verifying that the pool's origin matches the requested origin. All requests are dispatched through
    the pool connected to the first origin, regardless of the intended destination. This causes cross-origin
    request routing: credentials and request data intended for origin B are sent to origin A, responses from
    the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are
    applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more
    than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
    Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per
    origin, or avoid using Socks5ProxyAgent with multiple origins. (CVE-2026-6734)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins     without verifying that the pool's origin matches the requested origin. All requests are dispatched through     the pool connected to the first origin, regardless of the intended destination. This causes cross-origin     request routing: credentials and request data intended for origin B are sent to origin A, responses from     the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are     applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more     than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.
    Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per     origin, or avoid using Socks5ProxyAgent with multiple origins. (CVE-2026-6734)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330821	Fedora 44 : nodejs24 (2026-ce5dac2ed8)	Nessus	Fedora Local Security Checks	medium
330117	MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)	Nessus	Miracle Linux Local Security Checks	medium
329260	Oracle Linux 8 : nodejs:24 (ELSA-2026-39868)	Nessus	Oracle Linux Local Security Checks	medium
327431	AlmaLinux 8 : nodejs:24 (ALSA-2026:39868)	Nessus	Alma Linux Local Security Checks	medium
327374	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1920)	Nessus	Amazon Linux Local Security Checks	high
327252	RockyLinux 8 : nodejs:24 (RLSA-2026:39868)	Nessus	Rocky Linux Local Security Checks	medium
327198	RHEL 8 : nodejs:24 (RHSA-2026:39868)	Nessus	Red Hat Local Security Checks	medium
326382	Oracle Linux 9 : nodejs:24 (ELSA-2026-35891)	Nessus	Oracle Linux Local Security Checks	medium
326260	RockyLinux 10 : nodejs24 (RLSA-2026:35841)	Nessus	Rocky Linux Local Security Checks	medium
325495	AlmaLinux 9 : nodejs:24 (ALSA-2026:35891)	Nessus	Alma Linux Local Security Checks	medium
325300	RHEL 9 : nodejs:24 (RHSA-2026:35891)	Nessus	Red Hat Local Security Checks	medium
325298	RockyLinux 9 : nodejs:24 (RLSA-2026:35891)	Nessus	Rocky Linux Local Security Checks	medium
325263	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	Nessus	Alma Linux Local Security Checks	medium
325167	RHEL 10 : nodejs24 (RHSA-2026:35841)	Nessus	Red Hat Local Security Checks	medium
443608	SCA: security update for undici (GHSA-hm92-r4w5-c3mj)	Tenable Cloud Security	SCA Checks	high
443608	SCA: security update for undici (GHSA-hm92-r4w5-c3mj)	Tenable Self-Hosted Container Security	SCA Checks	high
321553	Linux Distros Unpatched Vulnerability : CVE-2026-6734	Nessus	Misc.	high

Detections

Analytics

CVE-2026-6734

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high