The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2422 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.20.0, 22.22.0, 24.13.0, 24.13.0, 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 13, 2026 Security Releases advisory.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. Impact: Thank you, to Nikita Skovoroda for reporting and fixing this     vulnerability. (CVE-2025-55131)

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system     compromise. Impact: Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for     fixing it. (CVE-2025-55130)

  - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by     triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process     crashes, enabling a remote denial of service. This primarily affects applications that do not attach     explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => {     socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to     dantt for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'),     the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22,     v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered     by deep recursion under specific conditions. This patch improves recoverability in one edge case, but it     does not remove the broader risk. Recovery from space exhaustion is unspecified, besteffort behavior and     is not a reliable basis for availability or security. In availabilitycritical paths where recursion depth     may be influenced by untrusted input, prefer input validation and designs that bound or avoid recursion     rather than depending on stack space exhaustion behavior or the lack of tailcall optimizations in the     runtime/engine. See this blog post for details. Impact: Thank you, to Andrew MacPherson (AndrewMohawk) for     identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-189:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-188:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-187:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2783 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0045 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-55130:
    A flaw in Node.jss Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-     write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script     granted access only to the current directory can escape the allowed path and read sensitive files. This     breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential     system compromise.
    This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.

    CVE-2025-55131:
    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers     allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data     from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact.

    CVE-2025-55132:
    A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply     the expected write-permission checks, which means file metadata can be modified in read-only directories.
    This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of     logs. This vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.

    CVE-2025-59465:
    A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by     triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the     process crashes, enabling a remote denial of service. This primarily affects applications that do not     attach explicit error handlers to secure sockets, for example:
    ```     server.on('secureConnection', socket => {     socket.on('error', err => {     console.log(err)     })     })     ```

    CVE-2025-59466:
    We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching     `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications     that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become     vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

    CVE-2026-21637:
    A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server     when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks     bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process     termination or silent file descriptor leaks that eventually lead to denial of service. Because these     callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly     trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js     versions where these callbacks throw without being safely wrapped.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1843 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1843 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2420 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2421 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2420 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2421 advisory.

    nodejs     [1:22.22.0-1]
    - Update to 22.22.0       Resolves: RHEL-118152

    nodejs-nodemon     [3.0.1-1]
    - Exclude ix86 arches from building.
      Related: RHEL-35991

    nodejs-packaging     [2021.06-4]
    - Exclude ix86 arches from building.
      Related: RHEL-35991

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
298534	RHEL 8 : nodejs:20 (RHSA-2026:2422)	Nessus	Red Hat Local Security Checks	2/10/2026	4/3/2026	medium
282656	Node.js 20.x < 20.20.0 / 22.x < 22.22.0 / 24.x < 24.13.0 / 24.x < 24.13.0 / 25.x < 25.3.0 Multiple Vulnerabilities (Tuesday, January 13, 2026 Security Releases).	Nessus	Misc.	1/13/2026	4/30/2026	medium
299282	MiracleLinux 8 : nodejs:24 (AXSA:2026-189:01)	Nessus	Miracle Linux Local Security Checks	2/17/2026	4/3/2026	medium
299283	MiracleLinux 8 : nodejs:22 (AXSA:2026-188:01)	Nessus	Miracle Linux Local Security Checks	2/17/2026	4/3/2026	medium
299288	MiracleLinux 8 : nodejs:20 (AXSA:2026-187:01)	Nessus	Miracle Linux Local Security Checks	2/17/2026	4/3/2026	medium
299297	RHEL 9 : nodejs:20 (RHSA-2026:2783)	Nessus	Red Hat Local Security Checks	2/17/2026	4/3/2026	medium
300877	Alibaba Cloud Linux 3 : 0045: nodejs:20 (ALINUX3-SA-2026:0045)	Nessus	Alibaba Cloud Linux Local Security Checks	3/5/2026	4/3/2026	medium
298020	Photon OS 4.0: Nodejs PHSA-2026-4.0-0956	Nessus	PhotonOS Local Security Checks	2/5/2026	4/3/2026	medium
298059	RHEL 10 : nodejs22 (RHSA-2026:1843)	Nessus	Red Hat Local Security Checks	2/5/2026	4/3/2026	medium
298207	RockyLinux 10 : nodejs22 (RLSA-2026:1843)	Nessus	Rocky Linux Local Security Checks	2/6/2026	4/3/2026	medium
298533	RHEL 8 : nodejs:24 (RHSA-2026:2420)	Nessus	Red Hat Local Security Checks	2/10/2026	4/3/2026	medium
298620	RockyLinux 8 : nodejs:22 (RLSA-2026:2421)	Nessus	Rocky Linux Local Security Checks	2/11/2026	4/3/2026	medium
298624	RockyLinux 8 : nodejs:24 (RLSA-2026:2420)	Nessus	Rocky Linux Local Security Checks	2/11/2026	4/3/2026	medium
298903	Oracle Linux 8 : nodejs:22 (ELSA-2026-2421)	Nessus	Oracle Linux Local Security Checks	2/13/2026	4/3/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium