The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2235:01 advisory.

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
      * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace     patterns (CVE-2026-102278)
      * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
      * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)
      * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
      * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
      * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
      * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
      * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
      * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
      * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)
      * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
      * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:96088 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * undici: undici: Denial of Service via unhandled stream error on excessive content encodings     (CVE-2026-109869)

    * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

    * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

    * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching     (CVE-2026-109829)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92376 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

    * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

    * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)

    * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

    * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92378 advisory.

    * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

    * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns     (CVE-2026-102278)

    * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

    * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns     (CVE-2026-102276)

    * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

    * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

    * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

    * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

    * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

    * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

    * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse     (CVE-2026-105481)

    * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

    * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

    Bug Fix(es) and Enhancement(s):

    * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
375192	MiracleLinux 8 : nodejs:24 (AXSA:2026-2235:01)	Nessus	Miracle Linux Local Security Checks	11/2/2026	11/6/2026	critical
377688	RHEL 10 : nodejs24 (RHSA-2026:96088)	Nessus	Red Hat Local Security Checks	11/9/2026	11/9/2026	critical
373945	RHEL 8 : nodejs:24 (RHSA-2026:92376)	Nessus	Red Hat Local Security Checks	10/30/2026	11/2/2026	critical
374187	RockyLinux 9 : nodejs:24 (RLSA-2026:92378)	Nessus	Rocky Linux Local Security Checks	10/30/2026	11/6/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical