The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:1583 advisory.

  - The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service)     attacks against the enclosure regular expression. (CVE-2021-35065)

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1744 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2654 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

    Security Fix(es):

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2655 advisory.

    - Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920
    - Resolves: CVE-2022-25881 CVE-2022-4904

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2654 advisory.

    - Resolves: CVE-2022-25881, CVE-2022-4904, CVE-2023-23936, CVE-2023-24807
    - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2655 advisory.

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0037 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-35065:
    The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service)     attacks against the enclosure regular expression.

    CVE-2022-25881:
    This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library.

    CVE-2022-3517:
    A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of     Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of     Service.

    CVE-2022-38900:
    decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

    CVE-2022-4904:
    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity.

    CVE-2023-23918:
    A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy.

    CVE-2023-23920:
    An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevatedprivileges.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_2655 advisory.

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6037:02 advisory.

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
      * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
      * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
      * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
      * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
      * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5289:01 advisory.

    * decode-uri-component: improper input validation resulting in DoS     (CVE-2022-38900)
      * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
      * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
      * c-ares: buffer overflow in config_sortlist() due to missing string length     check (CVE-2022-4904)
      * http-cache-semantics: Regular Expression Denial of Service (ReDoS)     vulnerability (CVE-2022-25881)
      * Node.js: Permissions policies can be bypassed via process.mainModule     (CVE-2023-23918)
      * Node.js: insecure loading of ICU data through ICU_DATA environment variable     (CVE-2023-23920)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
173997	Rocky Linux 8 : nodejs:18 (RLSA-2023:1583)	Nessus	Rocky Linux Local Security Checks	4/6/2023	11/6/2023	high
174180	RHEL 7 : rh-nodejs14-nodejs (RHSA-2023:1744)	Nessus	Red Hat Local Security Checks	4/12/2023	11/7/2024	high
175485	RHEL 9 : nodejs:18 (RHSA-2023:2654)	Nessus	Red Hat Local Security Checks	5/13/2023	3/6/2025	high
175990	Oracle Linux 9 : nodejs / and / nodejs-nodemon (ELSA-2023-2655)	Nessus	Oracle Linux Local Security Checks	5/17/2023	11/2/2024	high
175991	Oracle Linux 9 : nodejs:18 (ELSA-2023-2654)	Nessus	Oracle Linux Local Security Checks	5/17/2023	11/1/2024	high
176395	Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2023:2655)	Nessus	Rocky Linux Local Security Checks	5/25/2023	5/25/2023	high
236435	Alibaba Cloud Linux 3 : 0037: nodejs:14 (ALINUX3-SA-2023:0037)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
354127	Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-docs / etc Multiple Vulnerabilities (crlsa-2023_2655)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
291908	MiracleLinux 9 : nodejs-nodemon-2.0.20-3.el9, nodejs-16.19.1-1.el9 (AXSA:2023-6037:02)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
292034	MiracleLinux 8 : nodejs:14 (AXSA:2023-5289:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high