The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7896 advisory.

    - Update to version 20.20.2       Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change.
      Resolves: RHEL-164336       Fixes:  CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-8339 advisory.

    - Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change.
      Resolves: RHEL-154018       Fixes:  CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Rebase to 2.0.19       Resolves: CVE-2022-33987
    - Resolves CVE-2020-28469
    - Update to 2.0.7 to resolve CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0327 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-21710:
    A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a     header named __proto__ and the application accesses req.headersDistinct.

    When this occurs, dest[__proto__] resolves to Object.prototype rather than undefined, causing .push() to     be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be     intercepted by error event listeners, meaning it cannot be handled without wrapping every     req.headersDistinct access in a try/catch.

    * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

    CVE-2026-27135:
    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1,     the nghttp2 library stops reading the incoming data when user facing public API     nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They     might be called internally by the library when it detects the situation that is subject to connection     error. Due to the missing internal state validation, the library keeps reading the rest of the data after     one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes     assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known     workarounds are available.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce     regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in     V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7     seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most     severe finding: it is triggered by the default minimatch() API with no special options, and the minimum     viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7,     8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_8339 advisory.

    * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions     (CVE-2026-27904)

    * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination     (CVE-2026-27135)

    * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776782592 advisory.

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1. (CVE-2026-26996)

  - minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue. (CVE-2026-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
306467	Oracle Linux 9 : nodejs:20 (ELSA-2026-7896)	Nessus	Oracle Linux Local Security Checks	4/14/2026	4/14/2026	high
307484	Oracle Linux 8 : nodejs:20 (ELSA-2026-8339)	Nessus	Oracle Linux Local Security Checks	4/19/2026	4/19/2026	high
315216	TencentOS Server 3: nodejs:20 (TSSA-2026:0327)	Nessus	Tencent Local Security Checks	5/18/2026	5/18/2026	high
355138	Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_8339)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
352310	AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776782592)	Nessus	Alma Linux Local Security Checks	9/30/2026	9/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high