There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts
    because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to
    pass every element of a very large comma-part array as a function argument. Patterns containing many
    comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array
    path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before
    max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating
    denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts     because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to     pass every element of a very large comma-part array as a function argument. Patterns containing many     comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array     path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before     max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating     denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3277 advisory.

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts     because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to     pass every element of a very large comma-part array as a function argument. Patterns containing many     comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array     path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before     max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating     denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

    undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from     an earlier partial response while still presenting the original response's status and headers. This     happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for     example a non-success response whose headers were already sent or a partial-content response with an     unusable content range, then closes the connection and answers the resumed range request with more bytes.
    As a result the response body can be longer than the Content-Length that the application observes. An     application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can     emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the     start of a following response, which enables downstream response splitting or desynchronization.
    Exploitation requires an attacker-controlled upstream server and an application that forwards the response     through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and     from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2. (CVE-2026-18540)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit     PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as     normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version     7.5.18. (CVE-2026-59871)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL     bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach     fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version     7.5.17. (CVE-2026-59875)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in     src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and     no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L     or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path,     entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an     uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This     issue is fixed in version 7.5.21. (CVE-2026-73566)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3297 advisory.

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts     because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to     pass every element of a very large comma-part array as a function argument. Patterns containing many     comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array     path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before     max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating     denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()     function limits the number of results with a max option (default 100,000) but does not bound the length of     each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit     while making each result progressively longer, so total memory scales with both count and string length     until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input     ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced     strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can     be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds     accumulated output and intermediate arrays. (CVE-2026-14257)

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative     intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the     event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions     1.1.18, 2.1.4, 3.0.6, and 5.0.9. (CVE-2026-69152)

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to     10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG     URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the     network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports     correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.
    An application that builds a network trust-boundary decision on these checks, for example a filter     intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and     allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of     Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(),     and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.
    (CVE-2026-69192)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in     src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and     no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L     or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path,     entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an     uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This     issue is fixed in version 7.5.21. (CVE-2026-73566)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
460089	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/16/2026	high
460089	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/16/2026	high
351380	Linux Distros Unpatched Vulnerability : CVE-2026-102276	Nessus	Misc.	9/30/2026	10/23/2026	high
371836	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3277)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high
371895	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3297)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/25/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high