There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at
    optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a
    fixpoint loop, allowing generated globParts entries to be processed and expanded again.
    secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause
    excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
    (CVE-2026-118764)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at     optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a     fixpoint loop, allowing generated globParts entries to be processed and expanded again.
    secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause     excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
    (CVE-2026-118764)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:96226 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * undici: undici: Denial of Service via unhandled stream error on excessive content encodings     (CVE-2026-109869)

    * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

    * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

    * minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)

    * sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

    * sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

    * sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-96226 advisory.

    - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
    - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149       (memory exhaustion via deeply chained brace groups). as well as       CVE-2026-14257 (fixed in 5.0.8).
    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
    - CVE-2026-102278 nodejs-nodemon: brace-expansion: Denial of Service via       uncontrolled recursion in nested brace patterns
    - CVE-2026-118764 nodejs-nodemon: minimatch: Denial of Service via crafted       glob pattern expansion
    - CVE-2026-102276 nodejs-nodemon: brace-expansion: Denial of Service via       stack exhaustion from crafted brace patterns
    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:96226 advisory.

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * undici: undici: Denial of Service via unhandled stream error on excessive content encodings     (CVE-2026-109869)

    * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

    * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

    * minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)

    * sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

    * sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

    * sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_96226 advisory.

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * undici: undici: Denial of Service via unhandled stream error on excessive content encodings     (CVE-2026-109869)

    * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

    * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

    * minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)

    * sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

    * sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

    * sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
478051	SCA: security update for minimatch (GHSA-g3hv-75wg-m249)	Tenable Self-Hosted Container Security	SCA Checks	10/31/2026	11/4/2026	medium
478051	SCA: security update for minimatch (GHSA-g3hv-75wg-m249)	Tenable Cloud Security	SCA Checks	10/31/2026	11/4/2026	medium
374105	Linux Distros Unpatched Vulnerability : CVE-2026-118764	Nessus	Misc.	10/30/2026	11/5/2026	medium
377699	RHEL 9 : nodejs:24 (RHSA-2026:96226)	Nessus	Red Hat Local Security Checks	11/9/2026	11/10/2026	high
377971	Oracle Linux 9 : nodejs:24 (ELSA-2026-96226)	Nessus	Oracle Linux Local Security Checks	11/9/2026	11/9/2026	high
377982	RockyLinux 9 : nodejs:24 (RLSA-2026:96226)	Nessus	Rocky Linux Local Security Checks	11/9/2026	11/10/2026	high
378103	Rocky Linux 9 [CIQ] Security Update: nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2026_96226)	Nessus	Rocky Linux Local Security Checks	11/10/2026	11/10/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

high

high

high

high