There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows
    attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying
    SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive
    freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. (CVE-2026-119591)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - SQLite 之前 3.54.0 在 countOfViewOptimization（） 中包含堆疊耗盡弱點，可讓攻擊者透過大型多列 VALUES 子句上的 count（*） 使主機處理程序損毀。提供 SQL 或具有特製視圖的資料庫檔案的攻擊者可以觸發深度巢狀的 TK_PLUS 運算式，其 sqlite3ExprDeleteNN（） 中的遞迴釋放會耗盡 C 堆疊，從而造成拒絕服務。（CVE-2026-119591）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - SQLite 之前 3.54.0 在 countOfViewOptimization（） 中包含堆栈耗尽漏洞，可允许攻击者通过大型多行 VALUES 子句的 count（*） 使主机进程崩溃。攻击者可通过提供 SQL 或包含构建的视图的数据库文件触发深度嵌套的 TK_PLUS 表达式，其在 sqlite3ExprDeleteNN（） 中的递归释放耗尽了 C 堆栈，从而造成拒绝服务。（CVE-2026-119591）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 3.54.0 より前の SQLite には、countOfViewOptimization() にスタック枯渇の脆弱性が含まれており、攻撃者が大きな複数行の VALUES の句で count(*) を通じてホストプロセスをクラッシュさせる可能性があります。攻撃者は、SQL または細工されたビューを持つデータベースファイルを供給することで、深くネスト化された TK_PLUS 式を発生させ、その sqlite3ExprDeleteNN() での再帰解放により C スタックを使い果たし、サービス拒否を引き起こす可能性があります。(CVE-2026-119591)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、84cd82e1-d49f-11f1-bae2-3497f65b111b のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    VulnCheck による報告:
    SQLite 3.54.0 で修正された 10 件の脆弱性が 2026 年 10 月 30 日に公開されました。そのうちの 4 つはヒープを破損します:FTS5 関数 fts5MergeRowidLists() と fts5DoSecureDelete()、セッション拡張 sessionUpdateFind() のバッファオーバーフロー、および R-Tree 関数 nodeWrite() の use-after-free。5つ目は、FTS3関数fts3BestSnippet()のメモリ解放後使用(Use After Free)で、snippet()を介して到達します。
    残りの 5 つはプロセスのクラッシュまたはデータの漏洩を引き起こします:共通テーブル式のチェーン、COLLATE 演算子のチェーン、および VALUES 句の countOfViewOptimization() を通じた無限再帰、write-ahead ログのページサイズの不一致での情報漏洩、および RIGHT または FULL JOIN USING によるオーソライザーのバイパス。
    攻撃者はデータベースファイルまたはSQLテキストを指定する必要があるため、FTS5とFTS3の問題は、これらのオプションが組み込まれている場所ならどこでも当てはまります。
                両方とも databases/sqlite3 ではデフォルトでオンになっています。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3457 advisory.

    Node js security advisory: Permission Model filesystem over-grant via wildcard radix lookup     (CVE-2026-106071)

    undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an     Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a     conditional request can be validated by a 304 Not Modified from a different origin. When the origin that     stored the response redirects the conditional revalidation request to another origin, the redirect handler     strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since     validators, so the redirect destination receives the original origin's validator and undici treats its 304     as successful revalidation of the stored representation. As a result, a shared cache can serve the     original origin's stored authenticated response, including one gated by Authorization, to a later     unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of     those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin     dispatchers and cache stores, or disable shared caching on redirect-capable requests. (CVE-2026-116630)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the     SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it.
    Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an     untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
    (CVE-2026-119371)

    SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free     vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a     full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash     the process. (CVE-2026-119372)

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that     undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a     detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation,     corrupting heap memory and crashing the process. (CVE-2026-119373)

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows     attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a     database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts     heap memory and crashes the application. (CVE-2026-119374)

    SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read     uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft     a database and WAL file whose oversized record payload makes queries like substr() return stale bytes,     disclosing other table rows and internal pointers. (CVE-2026-119375)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the     SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000     chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in     sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)

    SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers     to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a     database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0,     crashing the process after node splits. (CVE-2026-119378)

    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in     sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets.
    Attackers can repeat a table name in a second changeset block with a larger column count, causing     sessionUpdateFind() to memset past the undersized aUpdateMask allocation. (CVE-2026-119379)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows     attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying     SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive     freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. (CVE-2026-119591)

    undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch     verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI     grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value     whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and     skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts     the response, so a server returning a body different from the pinned digest passes the check. An     application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-     controlled bytes with no integrity error, and the attacker needs only to control the response body, not     the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of     those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace,     using a single space to separate multiple digests. (CVE-2026-120423)

    undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the     redirect interceptor and a shared response cache are used together, an authenticated request that is     redirected to a same-origin target has the final response stored under the original request's cache key.
    That key omits the credential and carries no Vary header, so a later anonymous or different user can be     served the first user's private response body. This results in cross-user disclosure of cached private     responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those     versions or later. (CVE-2026-120474)

    A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker     corrupt process memory. When an application passes an attacker-controlled value such as a request's     :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a     buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end     of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-     of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This     vulnerability affects Node.js 26.x and 24.x. (CVE-2026-123828)

    An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting     while data is being compressed. zlib.params() queues a flush and completes its work in that write's     callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still     invokes the callback with an error, but the callback ignores its arguments and asserts that the native     handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream     internals and bypasses the stream's error event, the params() callback, and the pipeline() callback,     terminating the process. An application is affected only if it calls deflate.params() while streaming to a     peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123862)

    A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,     over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated     header buffers to outlive its session: the stream is removed from the session's stream set but never     detached, so when ~Http2Session() runs the memory accounting is nonzero and the     CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a     default http2 server whose handler responds before the request body has ended, which is typical. It is a     variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still     tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

    A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other     connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut()     directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP     parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-     entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then     copies that freed or unrelated heap memory into the response for the request body. Triggering it requires     a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-     empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request     body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123864)

    An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a     peer triggers a protocol error, for example an oversized frame header, while the session is already     shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling     session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in     memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by     sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case     of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not     shutting down, but missed terminations that arrive while the session is already shutting down. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

    A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of     other connections' response buffers, to a peer. When a stream is torn down while a write is still     backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the     stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated     heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the     teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is     present, and on all supported lines the same defect is reachable through an application-initiated teardown     such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123866)

    A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname     reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different     client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that     SNI context, the per-host client CA is never installed and the handshake falls back to the default client     CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext     succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI     context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not     the protected CA, can therefore complete mTLS to the protected hostname and read its response even with     requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123867)

    An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an     undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer     view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_:
    the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued     is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about     10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one     connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds     the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter     that never sees the queue. This vulnerability affects Node.js 26.x and 24.x. (CVE-2026-123868)

    Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established     that a proxy credential must not appear in a Node.js error message and redacted the username and password     from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the     same constructor, which interpolate the raw proxy URL, credentials included, into an     ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a     secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the     process environment, such as stderr, container logs, log aggregation, and crash reporting services. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123871)

    A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS     1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-     certificate policies per hostname, for example stricter admin-only client-cert auth on one host and     ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the     TLS 1.2 connection under a different servername and carry its existing authentication to the protected     host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123872)

    A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and     cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the     server free an Http2Stream while a write request that points to it is still queued on the socket; when     that write completes, the code dereferences and makes a virtual call through the freed object. The only     precondition is that the application serves a file with stream.respondWithFile() or     stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since     26.9.0) and 24.x (since 24.22.0). (CVE-2026-123874)

    A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both     TLS and cleartext, by cancelling file downloads. When the server serves a file with     stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used     for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting     the process. No crafted frames are needed, and a handful of cancelled requests against a default file-     serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123875)

    A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one     CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the     same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [],     because an omitted value appends nothing to the key while an empty array stringifies to an empty string.
    The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since     they share a key, a TLS session authenticated under the broader default policy is handed to a new     connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier     authentication forward, so the second request reports authorized === true and transmits confidential data     to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x,     24.x, and 22.x. (CVE-2026-123877)

    A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote,     unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback,     OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL     callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed     between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example,     no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL     deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the     deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event.
    This vulnerability affects Node.js 26.x and 24.x. (CVE-2026-126051)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows     attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying     SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive     freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. (CVE-2026-119591)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 84cd82e1-d49f-11f1-bae2-3497f65b111b advisory.

    VulnCheck reports:
    Ten vulnerabilities fixed in SQLite 3.54.0 were published on                 2026-10-30. Four of them corrupt the heap: buffer overflows in                 the FTS5 functions fts5MergeRowidLists() and                 fts5DoSecureDelete() and in the session extension                 sessionUpdateFind(), and a use-after-free in the R-Tree function                 nodeWrite(). A fifth, a use-after-free in the FTS3 function                 fts3BestSnippet(), is reached through snippet().
    The remaining five crash the process or leak data: unbounded                 recursion through a chain of common table expressions, through a                 chain of COLLATE operators and through countOfViewOptimization()                 in a VALUES clause, an information leak on a page size mismatch                 in the write-ahead log, and an authorizer bypass with RIGHT or                 FULL JOIN USING.
    An attacker has to supply a database file or SQL text, so the                 FTS5 and FTS3 issues apply wherever those options are built in;
                both are on by default in databases/sqlite3.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3456 advisory.

    Node js security advisory: Permission Model filesystem over-grant via wildcard radix lookup     (CVE-2026-106071)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the     SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it.
    Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an     untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
    (CVE-2026-119371)

    SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free     vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a     full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash     the process. (CVE-2026-119372)

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that     undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a     detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation,     corrupting heap memory and crashing the process. (CVE-2026-119373)

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows     attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a     database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts     heap memory and crashes the application. (CVE-2026-119374)

    SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read     uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft     a database and WAL file whose oversized record payload makes queries like substr() return stale bytes,     disclosing other table rows and internal pointers. (CVE-2026-119375)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the     SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000     chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in     sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)

    SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers     to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a     database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0,     crashing the process after node splits. (CVE-2026-119378)

    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in     sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets.
    Attackers can repeat a table name in a second changeset block with a larger column count, causing     sessionUpdateFind() to memset past the undersized aUpdateMask allocation. (CVE-2026-119379)

    SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows     attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying     SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive     freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. (CVE-2026-119591)

    An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting     while data is being compressed. zlib.params() queues a flush and completes its work in that write's     callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still     invokes the callback with an error, but the callback ignores its arguments and asserts that the native     handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream     internals and bypasses the stream's error event, the params() callback, and the pipeline() callback,     terminating the process. An application is affected only if it calls deflate.params() while streaming to a     peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123862)

    A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,     over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated     header buffers to outlive its session: the stream is removed from the session's stream set but never     detached, so when ~Http2Session() runs the memory accounting is nonzero and the     CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a     default http2 server whose handler responds before the request body has ended, which is typical. It is a     variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still     tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

    A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other     connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut()     directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP     parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-     entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then     copies that freed or unrelated heap memory into the response for the request body. Triggering it requires     a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-     empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request     body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123864)

    An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a     peer triggers a protocol error, for example an oversized frame header, while the session is already     shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling     session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in     memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by     sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case     of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not     shutting down, but missed terminations that arrive while the session is already shutting down. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

    A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of     other connections' response buffers, to a peer. When a stream is torn down while a write is still     backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the     stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated     heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the     teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is     present, and on all supported lines the same defect is reachable through an application-initiated teardown     such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123866)

    A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname     reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different     client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that     SNI context, the per-host client CA is never installed and the handshake falls back to the default client     CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext     succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI     context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not     the protected CA, can therefore complete mTLS to the protected hostname and read its response even with     requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123867)

    Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established     that a proxy credential must not appear in a Node.js error message and redacted the username and password     from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the     same constructor, which interpolate the raw proxy URL, credentials included, into an     ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a     secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the     process environment, such as stderr, container logs, log aggregation, and crash reporting services. This     vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123871)

    A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS     1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-     certificate policies per hostname, for example stricter admin-only client-cert auth on one host and     ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the     TLS 1.2 connection under a different servername and carry its existing authentication to the protected     host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123872)

    A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both     TLS and cleartext, by cancelling file downloads. When the server serves a file with     stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used     for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting     the process. No crafted frames are needed, and a handful of cancelled requests against a default file-     serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123875)

    A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one     CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the     same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [],     because an omitted value appends nothing to the key while an empty array stringifies to an empty string.
    The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since     they share a key, a TLS session authenticated under the broader default policy is handed to a new     connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier     authentication forward, so the second request reports authorized === true and transmits confidential data     to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x,     24.x, and 22.x. (CVE-2026-123877)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
478166	Echo: sqlite3: security update to 3.46.1-7+e9	Tenable Self-Hosted Container Security	Echo Local Security Checks	11/2/2026	11/4/2026	medium
478166	Echo: sqlite3: security update to 3.46.1-7+e9	Tenable Cloud Security	Echo Local Security Checks	11/2/2026	11/4/2026	medium
374306	Linux Distros 未修補弱點：CVE-2026-119591	Nessus	Misc.	10/30/2026	11/4/2026	medium
374306	Linux Distros 未修补的漏洞：CVE-2026-119591	Nessus	Misc.	10/30/2026	11/4/2026	medium
374306	Linux Distros のパッチ未適用の脆弱性: CVE-2026-119591	Nessus	Misc.	10/30/2026	11/4/2026	medium
374537	FreeBSD:sqlite3 -- 複数の脆弱性(84cd82e1-d49f-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	10/31/2026	11/6/2026	high
379887	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3457)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	high
374306	Linux Distros Unpatched Vulnerability : CVE-2026-119591	Nessus	Misc.	10/30/2026	11/4/2026	medium
374537	FreeBSD : sqlite3 -- multiple vulnerabilities (84cd82e1-d49f-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	10/31/2026	11/6/2026	high
379877	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3456)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/13/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

high

medium

high

high