The version of Node.js installed on the remote host is prior to 20.20.0, 22.22.0, 24.13.0, 24.13.0, 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 13, 2026 Security Releases advisory.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. Impact: Thank you, to Nikita Skovoroda for reporting and fixing this     vulnerability. (CVE-2025-55131)

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system     compromise. Impact: Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for     fixing it. (CVE-2025-55130)

  - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by     triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process     crashes, enabling a remote denial of service. This primarily affects applications that do not attach     explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => {     socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to     dantt for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'),     the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22,     v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered     by deep recursion under specific conditions. This patch improves recoverability in one edge case, but it     does not remove the broader risk. Recovery from space exhaustion is unspecified, besteffort behavior and     is not a reliable basis for availability or security. In availabilitycritical paths where recursion depth     may be influenced by untrusted input, prefer input validation and designs that bound or avoid recursion     rather than depending on stack space exhaustion behavior or the lack of tailcall optimizations in the     runtime/engine. See this blog post for details. Impact: Thank you, to Andrew MacPherson (AndrewMohawk) for     identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Node.js 20.x < 20.20.0 / 22.x < 22.22.0 / 24.x < 24.13.0 / 24.x < 24.13.0 / 25.x < 25.3.0 Multiple Vulnerabilities (Tuesday, January 13, 2026 Security Releases).

medium Nessus Plugin ID 282656

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.7 Oct 9, 2026, 6:12 PM New Plugin Feed: 202610091812
Version 1.6 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.5 Feb 17, 2026, 9:07 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 10.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2025-59465" to "CVE-2026-21636") CVSSv2 severity (based on CVE-2026-21636, severity increased from "Low" to "High") CVSSv3 severity (based on None, severity increased from "Low" to "High") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202602170907
Version 1.4 Jan 20, 2026, 4:27 AM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N") CVSS metrics ("CVSSv3 score" set to 3.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N") CVSS metrics ("Cvssv4 score" set to 4.8) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N") CVSSv2 severity (based on CVE-2025-59465, severity decreased from "Medium" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Low") CVSSv4 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601200427
Version 1.3 Jan 16, 2026, 10:12 PM Detection (updated detection logic) IAVM reference Plugin metadata STIG Severity (set to "I") Plugin Feed: 202601162212
Version 1.1 Jan 13, 2026, 7:55 PM New Plugin Feed: 202601131955