The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)
      * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35842 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)
      * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
      * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)
      * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)
      * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)
      * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
      * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)
      * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
      * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
      * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
      * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
      * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)
      * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)


    Bug Fix(es) and Enhancement(s):

      * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35892 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35892 advisory.

    - Update to version 22.23.1       Resolves: RHEL-186622 RHEL-185998 RHEL-183669       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory.

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

    * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

    * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response     delivery. (CVE-2026-6733)

    * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header     (CVE-2026-11525)

    * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

    * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent     connection routing (CVE-2026-6734)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35891 advisory.

    nodejs     [1:24.18.0-1]
    - Update to version 24.18.0

    nodejs-nodemon     [3.0.3-3]
    - Keep BR on just npm

    [3.0.3-2]
    - Fix BR for nodejs-npm

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121569

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39868 advisory.

    nodejs     [1:24.18.0-1]
    - Update to version 24.18.0       Resolves: RHEL-168744

    nodejs-nodemon     [3.0.3-1]
    - Initial import into nodejs:24 module

    nodejs-packaging     [2021.06-6]
    - Properly handle @group/package deps in nodejs-symlink-deps       Resolves: RHEL-121576

    [2021.06-5]
    - nodejs.req to properly detect bundled deps

    [2021.06-4]
    - NPM bundler: also find namespaced bundled dependencies

    [2021.06-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

    [2021.06-2]
    - Fix hard-coded output directory in the bundler

    [2021.06-1]
    - Update to 2021.06-1
    - bundler: Handle archaic license metadata
    - bundler: Warn about bundled dependencies with no license metadata

    [2021.01-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [2021.01-2]
    - nodejs-packaging-bundler improvements to handle uncommon characters

    [2021.01]
    - Add nodejs-packaging-bundler and update README.md

    [2020.09-1]
    - Move to dist-git as the upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
325263	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	Nessus	Alma Linux Local Security Checks	7/6/2026	7/6/2026	medium
325285	AlmaLinux 10 : nodejs22 (ALSA-2026:35842)	Nessus	Alma Linux Local Security Checks	7/6/2026	7/6/2026	medium
325297	RockyLinux 9 : nodejs:22 (RLSA-2026:35892)	Nessus	Rocky Linux Local Security Checks	7/7/2026	7/7/2026	medium
325788	Oracle Linux 9 : nodejs:22 (ELSA-2026-35892)	Nessus	Oracle Linux Local Security Checks	7/9/2026	7/9/2026	medium
326260	RockyLinux 10 : nodejs24 (RLSA-2026:35841)	Nessus	Rocky Linux Local Security Checks	7/10/2026	7/10/2026	medium
326382	Oracle Linux 9 : nodejs:24 (ELSA-2026-35891)	Nessus	Oracle Linux Local Security Checks	7/11/2026	7/11/2026	medium
329260	Oracle Linux 8 : nodejs:24 (ELSA-2026-39868)	Nessus	Oracle Linux Local Security Checks	7/23/2026	7/23/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium