The remote host is affected by the vulnerability described in GLSA-202505-11 (Node.js: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0613 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-27983:
    An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition.

    CVE-2024-27982:
    The team has identified a critical vulnerability in the http server of the most recent version of Node,     where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a     content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request     within the body of the first.

    CVE-2024-22019:
    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits.

    CVE-2023-46809:
    A flaw was found in Node.js. The privateDecrypt() API of the crypto library may allow a covert timing     side-channel during PKCS#1 v1.5 padding error handling. This issue revealed significant timing differences     in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decrypt captured RSA     ciphertexts or forge signatures, especially in scenarios involving API endpoints processing JSON Web     Encryption messages.

    CVE-2024-22025:
    A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
    The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making     it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL.
    An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration.

    CVE-2023-42282:
    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are     improperly categorized as globally routable via isPublic. A vulnerability was found in the NPM IP Package.
    This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the     isPublic() function by inducing a Server-Side Request Forgery (SSRF) attack and obtaining access to     normally inaccessible resources.

    CVE-2023-24807:
    Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0733-1 advisory.

    Security issues fixed:

    * CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack     against PKCS#1 v1.5 padding) (bsc#1219997).
    * CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (bsc#1219993).
    * CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
    * CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1757609292 advisory.

  - A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The     vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it     possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An     attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration. (CVE-2024-22025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has nodejs packages installed that are affected by multiple vulnerabilities:

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:2778 advisory.

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)
    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)
    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2780 advisory.

  - A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The     vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it     possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An     attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration. (CVE-2024-22025)

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

  - The team has identified a critical vulnerability in the http server of the most recent version of Node,     where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a     content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request     within the body of the first. (CVE-2024-27982)

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

  - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior     to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is     reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2     v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream.
    There is no workaround for this vulnerability. (CVE-2024-28182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2780 advisory.

    nodejs     [1:18.20.2-1]
    - Removes .ps1 files
    - Rebase to 18.20.2
    - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2853 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2910 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2910 advisory.

    [1:16.20.2-8.0.1]
    - Fix CVE-2024-28182, CVE-2024-22025, CVE-2024-25629, CVE-2024-27982, CVE-2024-27983

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
236407	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	5/14/2025	5/17/2025	critical
239018	TencentOS Server 4: nodejs (TSSA-2024:0613)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
191454	SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2024:0733-1)	Nessus	SuSE Local Security Checks	3/1/2024	6/25/2026	high
360921	AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1757609292)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	medium
297073	NewStart CGSL MAIN 6.06 : nodejs Multiple Vulnerabilities (NS-SA-2025-0241)	Nessus	NewStart CGSL Local Security Checks	1/28/2026	1/29/2026	critical
195207	AlmaLinux 8 : nodejs:20 (ALSA-2024:2778)	Nessus	Alma Linux Local Security Checks	5/9/2024	2/6/2025	medium
195229	Rocky Linux 8 : nodejs:18 (RLSA-2024:2780)	Nessus	Rocky Linux Local Security Checks	5/9/2024	2/6/2025	medium
195305	Oracle Linux 8 : nodejs:18 (ELSA-2024-2780)	Nessus	Oracle Linux Local Security Checks	5/10/2024	9/11/2025	medium
197085	RHEL 9 : nodejs:20 (RHSA-2024:2853)	Nessus	Red Hat Local Security Checks	5/15/2024	4/30/2025	medium
197505	RHEL 9 : nodejs (RHSA-2024:2910)	Nessus	Red Hat Local Security Checks	5/20/2024	2/6/2025	medium
197734	Oracle Linux 9 : nodejs (ELSA-2024-2910)	Nessus	Oracle Linux Local Security Checks	5/23/2024	9/11/2025	medium

Detections

Analytics

Plugins Search

critical

critical

high

medium

critical

medium

medium

medium

medium

medium

medium