The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0466 advisory.

    This advisory aggregates security fixes for the nodejs SRPM in CIQ LTS 9.2. It addresses 56 CVEs:
    CVE-2021-3918, CVE-2019-9517, CVE-2023-24807, CVE-2023-44487, CVE-2023-23936, and 51 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 9.2 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-docs / etc Multiple Vulnerabilities (ciqsa-2026_0466)

medium Nessus Plugin ID 355900

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.6 Oct 13, 2026, 11:47 AM Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610131147
Version 1.5 Oct 13, 2026, 2:52 AM CEA reference Plugin Feed: 202610130252
Version 1.4 Oct 12, 2026, 7:38 AM CVE (set "CVE" coverage to "CVE-2019-9511,CVE-2019-9512,CVE-2019-9513,CVE-2019-9514,CVE-2019-9515,CVE-2019-9516,CVE-2019-9517,CVE-2019-9518,CVE-2020-15095,CVE-2021-22918,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-22959,CVE-2021-22960,CVE-2021-27290,CVE-2021-3807,CVE-2021-3918,CVE-2021-43616,CVE-2021-44531,CVE-2021-44532,CVE-2021-44533,CVE-2021-44906,CVE-2022-21824,CVE-2022-25881,CVE-2022-29244,CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215,CVE-2022-35255,CVE-2022-35256,CVE-2022-4904,CVE-2023-23918,CVE-2023-23919,CVE-2023-23920,CVE-2023-23936,CVE-2023-24807,CVE-2023-30581,CVE-2023-30588,CVE-2023-30589,CVE-2023-30590,CVE-2023-31124,CVE-2023-31130,CVE-2023-31147,CVE-2023-32002,CVE-2023-32006,CVE-2023-32067,CVE-2023-32559,CVE-2023-44487,CVE-2024-22019,CVE-2024-22025,CVE-2024-25629,CVE-2024-27982,CVE-2024-27983,CVE-2024-28182") CVSS metrics ("CVSSv2 score" set to 7.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") CVSSv2 score source (changed from "CVE-2023-32002" to "CVE-2021-44906") CVSSv3 score source (set to "CVE-2023-32002") Exploit attributes ("Exploited by malware" changed from "True" to none) Plugin metadata Plugin Feed: 202610120738
Version 1.3 Oct 2, 2026, 1:05 PM Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610021305
Version 1.2 Oct 1, 2026, 9:59 PM CEA reference Plugin Feed: 202610012159