The version of Node.js installed on the remote host is prior to 20.20.2, 22.22.2, 24.14.1, 25.8.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, March 24, 2026 Security Releases advisory.

  - A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server     when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks     bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process     termination or silent file descriptor leaks that eventually lead to denial of service. Because these     callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly     trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js     versions where these callbacks throw without being safely wrapped. (CVE-2026-21637)

  - A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a     header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs,     `dest[__proto__]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called     on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted     by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct`     access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and     v25.x** (CVE-2026-21710)

  - A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations     without the required permission checks, while all comparable network paths correctly enforce them. As a     result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints,     allowing communication with other processes on the same host outside of the intended network restriction     boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-     net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an     experimental feature. (CVE-2026-21711)

  - A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called     with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js     process. (CVE-2026-21712)

  - A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided     signatures, potentially leaking timing information proportional to the number of matching bytes. Under     certain threat models where high-resolution timing measurements are possible, this behavior could be     exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison     primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional     design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. (CVE-2026-21713)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Node.js 20.x < 20.20.2 / 22.x < 22.22.2 / 24.x < 24.14.1 / 25.x < 25.8.2 Multiple Vulnerabilities (Tuesday, March 24, 2026 Security Releases).

high Nessus Plugin ID 303494

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.5 Aug 5, 2026, 2:10 PM Plugin metadata Plugin Feed: 202608051410
Version 1.4 May 1, 2026, 7:22 AM IAVM reference Plugin Feed: 202605010722
Version 1.3 Apr 4, 2026, 6:55 AM New Plugin Feed: 202604040655
Version 1.2 Apr 1, 2026, 10:26 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202604011026
Version 1.1 Mar 25, 2026, 3:40 AM New Plugin Feed: 202603250340