There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when
    Object.prototype has been polluted by any co-dependency with keys that axios reads without a
    hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the
    application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request
    credentials, headers, and body. The precondition is prototype pollution from a separate source in the same
    process. This vulnerability is fixed in 1.15.1 and 0.31.1. (CVE-2026-42033)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Axios 是一個基於承諾的 HTTP 用戶端，適用於瀏覽器與Node.js。在 和 1.15.10.31.1之前，當 Object.prototype 因任何與 axios 可讀取且未加 hasOwnProperty 保護的鍵的共依存性而污染時，攻擊者可以（a） 在應用程式看到前靜默攔截並修改每個 JSON 回應，或 （b） 完全劫持底層 HTTP 傳輸，取得請求憑證、標頭與主體的存取權。前提條件是同一過程中來自不同來源的原型污染。此弱點已在 1.15.1 和 0.31.1 中修正。(CVE-2026-42033)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Axios 是一个基于承诺的 HTTP 客户端，适用于浏览器和Node.js。在 和 1.15.10.31.1之前，当 Object.prototype 被 Object.prototype 与 axios 读取且没有 hasOwnProperty 保护的密钥共依赖污染时，攻击者可以（a） 在应用程序看到之前悄无声息地拦截并修改每个 JSON 响应，或 （b） 完全劫持底层 HTTP 传输，获得请求凭据、头部和正文的访问权限。前提条件是同一工艺中来自不同来源的原型污染。此漏洞已在 1.15.1 和 0.31.1 中修复。(CVE-2026-42033)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端主機上安裝的 Node.js 模組為 1.15.1 之前的版本，因此，會受到多個弱點影響：

  - axios 中的原型污染小工具允許響應篡改、數據洩露和請求劫持。
    (CVE-2026-42033)

  - 當 maxRedirects 設定為 0 時，Axios 的 HTTP 轉接器串流上傳會繞過 maxBodyLength。（CVE-2026-42034）

  - 透過 axios 中的原型污染進行標頭注入。（CVE-2026-42035）

  - Axios HTTP 轉接器串流回應會繞過 maxContentLength。（CVE-2026-42036）

  - 透過 IP 別名繞過 Axios no_proxy 允許 SSRF。（CVE-2026-42038）

  - toFormData 中的無限遞迴會透過深度巢狀要求資料造成拒絕服務。（CVE-2026-42039）

  - 不CVE-2025-62718完整的修復 - 透過 axios 1.15.0中的 RFC 1122 回送子網路 （127.0.0.0/8） 繞過的 NO_PROXY 保護。（CVE-2026-42043）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 axios Node.js 模块的版本低于 1.15.1。因此，该应用程序受到多个漏洞的影响：

  - axios 中的原型污染小工具允许响应篡改、数据渗漏和请求劫持。
    (CVE-2026-42033)

  - 当 maxRedirects 设置为 0 时，Axios 的 HTTP 适配器流式上传绕过 maxBodyLength。（CVE-2026-42034）

  - 通过 axios 中的原型污染进行标头注入。（CVE-2026-42035）

  - Axios HTTP 适配器流式响应绕过 maxContentLength。（CVE-2026-42036）

  - 通过 IP 别名绕过 Axios no_proxy 允许 SSRF。（CVE-2026-42038）

  - toFormData 中不受限制的递归可通过深度嵌套的请求数据造成拒绝服务。（CVE-2026-42039）

  - 不CVE-2025-62718完整的修复 - 通过 axios 1.15.0中的 RFC 1122 环回子网 （127.0.0.0/8） 绕过保护NO_PROXY保护。（CVE-2026-42043）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

リモートホストにインストールされている axios Node.js モジュールのバージョンは、1.15.1 より前です。そのため、以下の複数の脆弱性の影響を受けます。

  - axios のプロトタイプ汚染ガジェットにより、応答の改ざん、データ漏洩、リクエストのハイジャックが可能になります。
    (CVE-2026-42033)

  - maxRedirects が 0 に設定されている場合、Axios の HTTP アダプターストリームアップロードが maxBodyLength をバイパスします。(CVE-2026-42034)

  - axios のプロトタイプ汚染によるヘッダーインジェクション。(CVE-2026-42035)

  - Axios HTTP アダプターのストリームされた応答が maxContentLength をバイパスします。(CVE-2026-42036)

  - IP エイリアス経由の Axios no_proxy バイパスにより、SSRF が引き起こされる可能性があります。(CVE-2026-42038)

  - toFormData の無制限の再帰により、深くネストされたリクエストデータを介してサービス拒否が発生します。(CVE-2026-42039)

  - CVE-2025-62718 に対する不完全な修正 - axios 1.15.0 の RFC 1122 ループバックサブネット (127.0.0.0/8) を介して NO_PROXY 保護がバイパスされました。(CVE-2026-42043)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - AxiosはブラウザおよびNode.js向けの約束ベースのHTTPクライアントです。1.15.1や0.31.1以前は、Object.prototypeがhasOwnPropertyガードなしでAxiosが読み取る鍵との共依存関係によって汚染された場合、攻撃者は(a)アプリケーションがJSON応答を見る前に静かに遮蔽・改変するか、(b)基盤となるHTTPトランスポートを完全に乗っ取り、要求の認証情報、ヘッダー、本文へのアクセスを得ることができます。前提条件は、同じプロセス内で別の原因からの試作汚染です。この脆弱性は、1.15.1 および 0.31.1 で修正されています。(CVE-2026-42033)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1. (CVE-2026-42033)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42037:
    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1.

    CVE-2026-42035:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the     application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1     and 0.31.1.

    CVE-2026-42033:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1.

    CVE-2026-41242:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and     7.5.5, attackers can inject arbitrary code in the type fields of protobuf definitions, which will then     execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    CVE-2026-33896:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints     requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions.
    This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates,     which node-forge will accept as valid. Version 1.4.0 patches the issue.

    CVE-2026-33895:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the     scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both     verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by     the specification. This class of signature malleability has been exploited in practice to bypass     authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on     signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization     checks) may be bypassed. Version 1.4.0 patches the issue.

    CVE-2026-33894:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public     exponent keys (e=3). Attackers can forge signatures by stuffing garbage bytes within the ASN     structure in order to construct a signature that passes verification, enabling Bleichenbacher style     forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN     structure, rather than outside of it.  Additionally, forge does not validate that signatures include a     minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to     construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

    CVE-2026-33891:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an     infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When     modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an     unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0     patches the issue.

    CVE-2026-33228:
    flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2.

    CVE-2026-32141:
    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive()     phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested     or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the     Node.js process. This vulnerability is fixed in 3.4.0.

    CVE-2026-29074:
    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
    From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version     4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This     can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process     with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the axios Node.js module installed on the remote host is prior to 1.15.1. It is, therefore, affected by multiple vulnerabilities:

  - Prototype pollution gadgets in axios allow response tampering, data exfiltration, and request hijacking.
    (CVE-2026-42033)

  - Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects is set to 0. (CVE-2026-42034)

  - Header injection via prototype pollution in axios. (CVE-2026-42035)

  - Axios HTTP adapter streamed responses bypass maxContentLength. (CVE-2026-42036)

  - Axios no_proxy bypass via IP alias allows SSRF. (CVE-2026-42038)

  - Unbounded recursion in toFormData causes denial of service via deeply nested request data. (CVE-2026-42039)

  - Incomplete fix for CVE-2025-62718 - NO_PROXY protection bypassed via RFC 1122 loopback subnet (127.0.0.0/8)     in axios 1.15.0. (CVE-2026-42043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
441080	SCA: security update for axios (GHSA-pf86-5x62-jrwf)	Tenable Cloud Security	SCA Checks	5/5/2026	7/2/2026	high
441080	SCA: security update for axios (GHSA-pf86-5x62-jrwf)	Tenable Self-Hosted Container Security	SCA Checks	5/5/2026	7/2/2026	high
310515	Linux Distros 未修補的弱點：CVE-2026-42033	Nessus	Misc.	4/27/2026	7/26/2026	high
310515	Linux Distros 未修补的漏洞：CVE-2026-42033	Nessus	Misc.	4/27/2026	7/26/2026	high
313224	Node.js Module axios < 1.15.1 多個弱點	Nessus	Misc.	5/8/2026	5/21/2026	medium
313224	Node.js Module axios < 1.15.1 多个漏洞	Nessus	Misc.	5/8/2026	5/21/2026	medium
313224	Node.js Module axios < 1.15.1 の複数の脆弱性	Nessus	Misc.	5/8/2026	5/21/2026	medium
310515	Linux Distros のパッチ未適用の脆弱性: CVE-2026-42033	Nessus	Misc.	4/27/2026	7/26/2026	high
310515	Linux Distros Unpatched Vulnerability : CVE-2026-42033	Nessus	Misc.	4/27/2026	7/26/2026	high
319720	TencentOS Server 4: grafana (TSSA-2026:0295)	Nessus	Tencent Local Security Checks	6/8/2026	6/8/2026	critical
313224	Node.js Module axios < 1.15.1 Multiple Vulnerabilities	Nessus	Misc.	5/8/2026	5/21/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

medium

medium

medium

high

high

critical

medium