The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:2778 advisory.

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)
    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)
    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2780 advisory.

  - A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The     vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it     possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An     attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration. (CVE-2024-22025)

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

  - The team has identified a critical vulnerability in the http server of the most recent version of Node,     where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a     content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request     within the body of the first. (CVE-2024-27982)

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

  - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior     to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is     reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2     v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream.
    There is no workaround for this vulnerability. (CVE-2024-28182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2780 advisory.

    nodejs     [1:18.20.2-1]
    - Removes .ps1 files
    - Rebase to 18.20.2
    - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2910 advisory.

    [1:16.20.2-8.0.1]
    - Fix CVE-2024-28182, CVE-2024-22025, CVE-2024-25629, CVE-2024-27982, CVE-2024-27983

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1301-1 advisory.

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

  - The team has identified a vulnerability in the http server of the most recent version of Node, where     malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-     length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within     the body of the first. Impacts: Thank you, to bpingel for reporting this vulnerability and Paolo Insogna     for fixing it.  Summary The Node.js project will release new versions of the 18.x, 20.x, 21.x releases     lines on or shortly after, Wednesday, April 3, 2024 in order to address: (CVE-2024-27982)

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-     Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was     patched in version(s) 5.28.4 and 6.11.1. (CVE-2024-30260)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity`     option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been     tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1. (CVE-2024-30261)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2853 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2910 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3545 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0613 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-27983:
    An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition.

    CVE-2024-27982:
    The team has identified a critical vulnerability in the http server of the most recent version of Node,     where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a     content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request     within the body of the first.

    CVE-2024-22019:
    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits.

    CVE-2023-46809:
    A flaw was found in Node.js. The privateDecrypt() API of the crypto library may allow a covert timing     side-channel during PKCS#1 v1.5 padding error handling. This issue revealed significant timing differences     in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decrypt captured RSA     ciphertexts or forge signatures, especially in scenarios involving API endpoints processing JSON Web     Encryption messages.

    CVE-2024-22025:
    A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through     resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
    The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making     it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL.
    An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory,     potentially leading to process termination, depending on the system configuration.

    CVE-2023-42282:
    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are     improperly categorized as globally routable via isPublic. A vulnerability was found in the NPM IP Package.
    This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the     isPublic() function by inducing a Server-Side Request Forgery (SSRF) attack and obtaining access to     normally inaccessible resources.

    CVE-2023-24807:
    Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
195207	AlmaLinux 8 : nodejs:20 (ALSA-2024:2778)	Nessus	Alma Linux Local Security Checks	5/9/2024	2/6/2025	medium
195229	Rocky Linux 8 : nodejs:18 (RLSA-2024:2780)	Nessus	Rocky Linux Local Security Checks	5/9/2024	2/6/2025	medium
195305	Oracle Linux 8 : nodejs:18 (ELSA-2024-2780)	Nessus	Oracle Linux Local Security Checks	5/10/2024	9/11/2025	medium
197734	Oracle Linux 9 : nodejs (ELSA-2024-2910)	Nessus	Oracle Linux Local Security Checks	5/23/2024	9/11/2025	medium
193392	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:1301-1)	Nessus	SuSE Local Security Checks	4/17/2024	4/17/2024	high
197085	RHEL 9 : nodejs:20 (RHSA-2024:2853)	Nessus	Red Hat Local Security Checks	5/15/2024	4/30/2025	medium
197505	RHEL 9 : nodejs (RHSA-2024:2910)	Nessus	Red Hat Local Security Checks	5/20/2024	2/6/2025	medium
200062	RHEL 9 : nodejs (RHSA-2024:3545)	Nessus	Red Hat Local Security Checks	6/3/2024	11/7/2024	high
239018	TencentOS Server 4: nodejs (TSSA-2024:0613)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium

high

critical