Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2695-1 advisory.

    - CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).
    - CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).
    - CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).
    - CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).
    - CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).
    - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).
    - CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).
    - CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).
    - CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).
    - CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).
    - CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery ( bsc#1268479).
    - CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding (     bsc#1268477).
    - CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie     header (bsc#1268481).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec` ( bsc#1266318).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21058-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2647-1 advisory.

    This update for nodejs22 fixes the following issues

    Update to 22.23.0:

    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via     the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted     spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing     excessive CPU consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	high
324854	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2695-1)	Nessus	SuSE Local Security Checks	high
324066	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21058-1)	Nessus	SuSE Local Security Checks	high
323244	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:2647-1)	Nessus	SuSE Local Security Checks	high
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	high
318737	Linux Distros Unpatched Vulnerability : CVE-2026-9496	Nessus	Misc.	high

Detections

Analytics

CVE-2026-9496

high

Tenable Plugins

high

high

high

high

high

high