The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61386 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613860 advisory.

    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613830 advisory.

    - Update to version 22.23.2       Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043       Resolves: RHEL-234381 RHEL-234831 RHEL-234896

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62583 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-625830 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1753:01 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_61377 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    Bug Fix(es) and Enhancement(s):

    * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-220543)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788538849 advisory.

  - A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and     enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
    (CVE-2026-56846)

  - A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while     `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects     Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
342023	RockyLinux 9 : nodejs:24 (RLSA-2026:61386)	Nessus	Rocky Linux Local Security Checks	8/31/2026	9/1/2026	high
342443	Oracle Linux 9 : ELSA-2026-61386-0: / nodejs:24 (ELSA-2026-613860)	Nessus	Oracle Linux Local Security Checks	9/2/2026	9/2/2026	high
342444	Oracle Linux 9 : ELSA-2026-61383-0: / nodejs:22 (ELSA-2026-613830)	Nessus	Oracle Linux Local Security Checks	9/2/2026	9/2/2026	high
342451	RockyLinux 8 : nodejs:24 (RLSA-2026:62583)	Nessus	Rocky Linux Local Security Checks	9/2/2026	9/3/2026	high
342701	Oracle Linux 8 : ELSA-2026-62583-0: / nodejs:24 (ELSA-2026-625830)	Nessus	Oracle Linux Local Security Checks	9/3/2026	9/3/2026	high
342732	MiracleLinux 8 : nodejs:22 (AXSA:2026-1753:01)	Nessus	Miracle Linux Local Security Checks	9/4/2026	9/6/2026	high
356998	Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_61377)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
361244	AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788538849)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high