The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2655 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon     (2.0.20).

    Security Fix(es):

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2655 advisory.

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6072:01 advisory.

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
      * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
      * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
      * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
      * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
      * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
      * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
      * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175489	RHEL 9 : nodejs and nodejs-nodemon (RHSA-2023:2655)	Nessus	Red Hat Local Security Checks	5/13/2023	3/6/2025	high
175641	AlmaLinux 9 : nodejs and nodejs-nodemon (ALSA-2023:2655)	Nessus	Alma Linux Local Security Checks	5/14/2023	5/14/2023	high
236956	Photon OS 4.0: Nodejs PHSA-2025-4.0-0801	Nessus	PhotonOS Local Security Checks	5/20/2025	5/20/2025	critical
292425	MiracleLinux 9 : nodejs:18 (AXSA:2023-6072:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

high

critical

high