It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1403 advisory.

    Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption.

    While exploitation typically requires precise timing or in-process code execution, it can become remotely     exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality     and integrity impact. (CVE-2025-55131)

    fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

    Uncatchable Maximum call stack size exceeded error on Node.js via async_hooks leads to process crashes     bypassing error handlers (CVE-2025-59466)

    TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

    NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-     exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1842 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1842 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1842 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1843 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2422 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2421 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2781 advisory.

    nodejs     [1:24.13.0-1]
    - Update to version 24.13.0

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121581

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2781 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

    * nodejs: Nodejs denial of service (CVE-2026-21637)

    * nodejs: Nodejs denial of service (CVE-2025-59466)

    * nodejs: Nodejs denial of service (CVE-2025-59465)

    * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

    * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-209:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-212:01 advisory.

    * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)
      * nodejs: Nodejs denial of service (CVE-2026-21637)
      * nodejs: Nodejs denial of service (CVE-2025-59466)
      * nodejs: Nodejs denial of service (CVE-2025-59465)
      * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)
      * nodejs: Nodejs file permissions bypass (CVE-2025-55130)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
298096	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1403)	Nessus	Amazon Linux Local Security Checks	2/5/2026	4/3/2026	medium
298159	RHEL 10 : nodejs24 (RHSA-2026:1842)	Nessus	Red Hat Local Security Checks	2/5/2026	4/3/2026	medium
298205	RockyLinux 10 : nodejs24 (RLSA-2026:1842)	Nessus	Rocky Linux Local Security Checks	2/6/2026	4/3/2026	medium
298508	AlmaLinux 10 : nodejs24 (ALSA-2026:1842)	Nessus	Alma Linux Local Security Checks	2/10/2026	4/21/2026	medium
298509	AlmaLinux 10 : nodejs22 (ALSA-2026:1843)	Nessus	Alma Linux Local Security Checks	2/10/2026	4/3/2026	medium
298618	RockyLinux 8 : nodejs:20 (RLSA-2026:2422)	Nessus	Rocky Linux Local Security Checks	2/11/2026	4/3/2026	medium
299015	AlmaLinux 8 : nodejs:22 (ALSA-2026:2421)	Nessus	Alma Linux Local Security Checks	2/13/2026	4/3/2026	medium
299336	Oracle Linux 9 : nodejs:24 (ELSA-2026-2781)	Nessus	Oracle Linux Local Security Checks	2/17/2026	4/3/2026	medium
299389	RockyLinux 9 : nodejs:24 (RLSA-2026:2781)	Nessus	Rocky Linux Local Security Checks	2/18/2026	4/3/2026	medium
299682	MiracleLinux 9 : nodejs:24 (AXSA:2026-209:01)	Nessus	Miracle Linux Local Security Checks	2/20/2026	4/3/2026	medium
299684	MiracleLinux 9 : nodejs:22 (AXSA:2026-212:01)	Nessus	Miracle Linux Local Security Checks	2/20/2026	4/3/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium