The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0609-1 advisory.

    Update to LTS version 16.19.1:

    - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule     (bsc#1208481).
    - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
    - CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
    - CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
    - CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and     Headers.append() methods (bsc#1208413).

    Bug fixes:

    - Workaround for failing openssl-nodejs test (bsc#1205568).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0608-1 advisory.

    Update to LTS version 16.19.1:

    - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule     (bsc#1208481).
    - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
    - CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
    - CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
    - CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and     Headers.append() methods (bsc#1208413).

    Bug fixes:

    - Workaround for failing openssl-nodejs test (bsc#1205568).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-973319d5b7 advisory.

    Fixes for virtual Provides/Requires of `nodejs` and `nodejs-devel`

    ----

    Assorted fixes for v8-devel

    ----

    Update to 19.8.1

    Fix confilct with nodejs18


    ----

    ## 2023-02-16, Version 16.19.1 'Gallium' (LTS), @richardlau

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions     policies can be bypassed via process.mainModule (High)
    * **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL     error handling issues in nodejs crypto library (Medium)
    * **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure     loading of ICU data through ICU\_DATA environment variable (Low)

    Fixed by an update to undici:

    * **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in     Node.js did not protect against CRLF injection in host headers (Medium)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff> for more information.
    * **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression     Denial of Service in Headers in Node.js fetch API (Low)
      * See <https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w> for more information.

    More detailed information on each of the vulnerabilities can be found in [February 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post.

    This security release includes OpenSSL security updates as outlined in the recent     [OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt).

    ### Commits

    * \[[`7fef050447`](https://github.com/nodejs/node/commit/7fef050447)] - **build**: build ICU with     ICU\_NO\_USER\_DATA\_OVERRIDE (RafaelGSS) [nodejs-private/node-private#374](https://github.com/nodejs-     private/node-private/pull/374)
    * \[[`b558e9f476`](https://github.com/nodejs/node/commit/b558e9f476)] - **crypto**: clear OpenSSL error on     invalid ca cert (RafaelGSS) [nodejs-private/node-private#375](https://github.com/nodejs-private/node-     private/pull/375)
    * \[[`160adb7ffc`](https://github.com/nodejs/node/commit/160adb7ffc)] - **crypto**: clear OpenSSL error     queue after calling X509\_check\_private\_key() (Filip Skokan)     [#45495](https://github.com/nodejs/node/pull/45495)
    * \[[`d0ece30948`](https://github.com/nodejs/node/commit/d0ece30948)] - **crypto**: clear OpenSSL error     queue after calling X509\_verify() (Takuro Sato) [#45377](https://github.com/nodejs/node/pull/45377)
    * \[[`2d9ae4f184`](https://github.com/nodejs/node/commit/2d9ae4f184)] - **deps**: update undici to v5.19.1     (Matteo Collina) [nodejs-private/node-private#388](https://github.com/nodejs-private/node-     private/pull/388)
    * \[[`d80e8312fd`](https://github.com/nodejs/node/commit/d80e8312fd)] - **deps**: cherry-pick Windows     ARM64 fix for openssl (Richard Lau) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`de5c8d2c2f`](https://github.com/nodejs/node/commit/de5c8d2c2f)] - **deps**: update archs files for     quictls/openssl-1.1.1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`1a8ccfe908`](https://github.com/nodejs/node/commit/1a8ccfe908)] - **deps**: upgrade openssl sources     to OpenSSL\_1\_1\_1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)
    * \[[`693789780b`](https://github.com/nodejs/node/commit/693789780b)] - **doc**: clarify release notes for     Node.js 16.19.0 (Richard Lau) [#45846](https://github.com/nodejs/node/pull/45846)
    * \[[`f95ef064f4`](https://github.com/nodejs/node/commit/f95ef064f4)] - **lib**: makeRequireFunction patch     when experimental policy (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-     private/node-private/pull/358)
    * \[[`b02d895137`](https://github.com/nodejs/node/commit/b02d895137)] - **policy**: makeRequireFunction on     mainModule.require (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-private/node-     private/pull/358)
    * \[[`d7f83c420c`](https://github.com/nodejs/node/commit/d7f83c420c)] - **test**: avoid left behind child     processes (Richard Lau) [#46276](https://github.com/nodejs/node/pull/46276)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

    Security Fix(es):

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-1743 advisory.

    nodejs     [1:14.21.3-1]
    - Rebase to 14.21.3       Resolves: rhbz#2153712       Resolves: CVE-2022-25881 CVE-2023-23918 CVE-2023-23920 CVE-2022-38900       Resolves: CVE-2022-4904

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2654 advisory.

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
    * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1533 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * minimist: prototype pollution (CVE-2021-44906)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

ID	Name	Product	Family	Published	Updated	Severity
172097	SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2023:0609-1)	Nessus	SuSE Local Security Checks	3/4/2023	6/26/2026	high
172099	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2023:0608-1)	Nessus	SuSE Local Security Checks	3/5/2023	6/26/2026	high
173881	Fedora 38 : nodejs16 / nodejs18 / nodejs20 (2023-973319d5b7)	Nessus	Fedora Local Security Checks	4/5/2023	11/14/2024	high
189668	RHEL 8 : nodejs:18 (RHSA-2023:1583)	Nessus	Red Hat Local Security Checks	1/26/2024	3/6/2025	high
174231	Oracle Linux 8 : nodejs:14 (ELSA-2023-1743)	Nessus	Oracle Linux Local Security Checks	4/13/2023	11/1/2024	high
175571	AlmaLinux 9 : nodejs:18 (ALSA-2023:2654)	Nessus	Alma Linux Local Security Checks	5/13/2023	1/13/2025	high
173777	RHEL 8 : nodejs:14 (RHSA-2023:1533)	Nessus	Red Hat Local Security Checks	4/2/2023	11/7/2024	critical
332189	Photon OS 5.0: Nodejs PHSA-2023-5.0-91-0011	Nessus	PhotonOS Local Security Checks	8/5/2026	8/6/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high