Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

oracle_linux ELSA-2026-35891: ELSA-2026-35891:  nodejs:24 security, bug fix, and enhancement update (IMPORTANT)

amazon_alas ALAS2023-2026-1920: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1920

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21236-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to version 24.18.0 (bsc#1269825).

    Security issues fixed:

    - CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect     response delivery       (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).
    - CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie`     header       (bsc#1268481).
    - CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due     to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames     (bsc#1268618).
    - CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive       hostname matching (bsc#1268605).
    - CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string`     truncation in       resolver bindings (bsc#1268606).
    - CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).
    - CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername`     leads to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

    Other updates and bugfixes:
    - Version 24.18.0:
      - doc: update `blockList` stability status to release candidate
      - fs: support caller-supplied `readFile()` buffers
      - http: close pre-request sockets in `closeIdleConnections`
      - loader: implement package maps
      - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`
      - tls: add `certificateCompression` option
      - vfs: dispatch `node:fs/promises` to mounted VFS instances
      - vfs: add minimal `node:vfs` subsystem
    - For changes in older versions, see https://github.com/nodejs/node/releases.
    - Remove `update-alternatives` from scriptlets if not available.
    - Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.
    - Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure     with GCC 16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35892 advisory.

    - Update to version 22.23.1       Resolves: RHEL-186622 RHEL-185998 RHEL-183669       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35842 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35892 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [almalinux-9.8.z] (JIRA:AlmaLinux-186622)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-186580)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35892 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-186622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35891 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-186580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35891 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35892 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35842 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35842 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:RHEL-186623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35841 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-186582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory.

    This update for nodejs24 fixes the following issues

    Update to 24.17.0:

    - CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted     `spec.rawSpec`       value can lead to DoS (bsc#1266318).
    - CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing     (bsc#1268478).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).
    - CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (bsc#1268097).
    - CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).
    - CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path     misvalidation       (bsc#1268554).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream     Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=     authorization or no-cache=\tauthorization. The parser preserves the surrounding whitespace, so later     comparisons against the literal authorization field name fail and the response is stored. In shared-cache     mode, this allows a response containing one user's authenticated data to be served from cache to a     subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.
    Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in     shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical     qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If     upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization     headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
    (CVE-2026-9678)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream
    Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private="
    authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later
    comparisons against the literal authorization field name fail and the response is stored. In shared-cache
    mode, this allows a response containing one user's authenticated data to be served from cache to a
    subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.
    Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in
    shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical
    qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If
    upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization
    headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
    (CVE-2026-9678)

ID	Name	Product	Family	Severity
326260	RockyLinux 10 : nodejs24 (RLSA-2026:35841)	Nessus	Rocky Linux Local Security Checks	medium
326024	openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21236-1)	Nessus	SuSE Local Security Checks	high
325788	Oracle Linux 9 : nodejs:22 (ELSA-2026-35892)	Nessus	Oracle Linux Local Security Checks	medium
325656	RockyLinux 10 : nodejs22 (RLSA-2026:35842)	Nessus	Rocky Linux Local Security Checks	medium
325502	AlmaLinux 9 : nodejs:22 (ALSA-2026:35892)	Nessus	Alma Linux Local Security Checks	medium
325495	AlmaLinux 9 : nodejs:24 (ALSA-2026:35891)	Nessus	Alma Linux Local Security Checks	medium
325303	RHEL 9 : nodejs:22 (RHSA-2026:35892)	Nessus	Red Hat Local Security Checks	medium
325300	RHEL 9 : nodejs:24 (RHSA-2026:35891)	Nessus	Red Hat Local Security Checks	medium
325298	RockyLinux 9 : nodejs:24 (RLSA-2026:35891)	Nessus	Rocky Linux Local Security Checks	medium
325297	RockyLinux 9 : nodejs:22 (RLSA-2026:35892)	Nessus	Rocky Linux Local Security Checks	medium
325285	AlmaLinux 10 : nodejs22 (ALSA-2026:35842)	Nessus	Alma Linux Local Security Checks	medium
325263	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	Nessus	Alma Linux Local Security Checks	medium
325168	RHEL 10 : nodejs22 (RHSA-2026:35842)	Nessus	Red Hat Local Security Checks	medium
325167	RHEL 10 : nodejs24 (RHSA-2026:35841)	Nessus	Red Hat Local Security Checks	medium
323047	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)	Nessus	SuSE Local Security Checks	high
321577	Linux Distros Unpatched Vulnerability : CVE-2026-9678	Nessus	Misc.	medium
443470	SCA: security update for undici (GHSA-pr7r-676h-xcf6)	Tenable Cloud Security	SCA Checks	medium
443470	SCA: security update for undici (GHSA-pr7r-676h-xcf6)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-9678

medium

Tenable Plugins

Coming Soon

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium