The version of nodejs / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47279 advisory.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1010 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Improper HTTP header block termination in llhttp which enables request smuggling, allowing attackers to     bypass proxy-based access controls and submit unauthorized requests. This vulnerability affects only     Node.js 20.x users prior to the llhttp v9 upgrade.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-     termination-in-llhttp-cve-2025-23167---medium (CVE-2025-23167)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs / nodejs18 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47279 advisory.

  - Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1009 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0415 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-47279:
    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.

    The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.

    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23165:
    In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`:
    a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This     results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth,     leading to a denial of service.

    Impact:
    * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
241949	CBL Mariner 2.0 Security Update: nodejs / nodejs18 (CVE-2025-47279)	Nessus	MarinerOS Local Security Checks	7/11/2025	7/11/2025	low
250317	Linux Distros Unpatched Vulnerability : CVE-2025-47279	Nessus	Misc.	8/18/2025	10/14/2025	low
238264	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-1010)	Nessus	Amazon Linux Local Security Checks	6/12/2025	6/12/2025	medium
241941	Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2025-47279)	Nessus	Azure Linux Local Security Checks	7/11/2025	9/15/2025	low
238268	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2025-1009)	Nessus	Amazon Linux Local Security Checks	6/12/2025	6/12/2025	high
276095	TencentOS Server 4: nodejs20 (TSSA-2025:0415)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	medium

Detections

Analytics

Plugins Search

low

low

medium

low

high

medium