The remote NewStart CGSL host, running version MAIN 6.06, has nodejs packages installed that are affected by multiple vulnerabilities:

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

NewStart CGSL MAIN 6.06 : nodejs Multiple Vulnerabilities (NS-SA-2025-0241)

critical Nessus Plugin ID 297073

Version 1.2

Version 1.1

Version 1.2 Jan 30, 2026, 9:16 AM CEA reference Plugin Feed: 202601300916
Version 1.1 Jan 29, 2026, 5:23 AM New Plugin Feed: 202601290523