The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0050 advisory.

    - Apply upstream fix for CVE-2022-24999       Resolves: CVE-2022-24999
    - Record CVEs fixed by current or previous upstream releases       Resolves: CVE-2021-44906

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0321 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon     (2.0.20).

    Security Fix(es):

    * minimist: prototype pollution (CVE-2021-44906)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs: Packaged version of undici does not fit with declared version. [rhel-9] (BZ#2151627)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5326 advisory.

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

  - A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with     EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems     with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can     (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically     strong and therefore not suitable as keying material. (CVE-2022-35255)

  - The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not     terminated with CLRF. This may result in HTTP Request Smuggling. (CVE-2022-35256)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8832 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809,     BZ#2142830, BZ#2142834, BZ#2142856)

    Security Fix(es):

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4547:01 advisory.

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
      * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
      * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
      * minimist: prototype pollution (CVE-2021-44906)
      * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
      * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
      * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4653:01 advisory.

    * minimist: prototype pollution (CVE-2021-44906)
      * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
      * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
      * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)
      * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
169719	Oracle Linux 8 : nodejs:14 (ELSA-2023-0050)	Nessus	Oracle Linux Local Security Checks	1/9/2023	11/1/2024	critical
170406	RHEL 9 : nodejs and nodejs-nodemon (RHSA-2023:0321)	Nessus	Red Hat Local Security Checks	1/23/2023	3/6/2025	critical
170655	Debian DSA-5326-1 : nodejs - security update	Nessus	Debian Local Security Checks	1/25/2023	9/6/2023	critical
168421	RHEL 9 : nodejs:18 (RHSA-2022:8832)	Nessus	Red Hat Local Security Checks	12/6/2022	3/6/2025	high
293035	MiracleLinux 8 : nodejs:16 (AXSA:2022-4547:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
293711	MiracleLinux 8 : nodejs:14 nodejs-nodemon-2.0.20-2.module+el8+1579+35966ec0, nodejs-packaging-23-3.module+el8+1579+35966ec0, nodejs-14.21.1-2.module+el8+1579+35966ec0 (AXSA:2023-4653:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical