The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b7ad50870e advisory.

    Update to version 22.22.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8663c5f961 advisory.

    Update to version 22.22.0





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A memory leak in Node.js's OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8     without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each     certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated     TLS connections. Over time this can lead to resource exhaustion and denial of service. (CVE-2025-59464)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb4878551d advisory.

    Update to version 20.20.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1299-1 advisory.

    - Update to 24.14.1
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21712: malformed URL format can lead to a crash (bsc#1260460).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure     (bsc#1260482).
    - CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership     (bsc#1260462).
    - CVE-2026-21717: crafted request can lead to trivially predictable hash collisions (bsc#1260494).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.20.0, 22.22.0, 24.13.0, 24.13.0, 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 13, 2026 Security Releases advisory.

  - A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via     futimes() even when the process has only read permissions. Unlike utimes(), futimes() does not apply the     expected write-permission checks, which means file metadata can be modified in read-only directories. This     behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs     (CVE-2025-55132)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. Impact: Thank you, to Nikita Skovoroda for reporting and fixing this     vulnerability. (CVE-2025-55131)

  - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write     restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted     access only to the current directory can escape the allowed path and read sensitive files. This breaks the     expected isolation guarantees and enables arbitrary file read/write, leading to potential system     compromise. Impact: Thank you, to natann for reporting this vulnerability and thank you RafaelGSS for     fixing it. (CVE-2025-55130)

  - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by     triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process     crashes, enabling a remote denial of service. This primarily affects applications that do not attach     explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => {     socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to     dantt for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'),     the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22,     v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered     by deep recursion under specific conditions. This patch improves recoverability in one edge case, but it     does not remove the broader risk. Recovery from space exhaustion is unspecified, besteffort behavior and     is not a reliable basis for availability or security. In availabilitycritical paths where recursion depth     may be influenced by untrusted input, prefer input validation and designs that bound or avoid recursion     rather than depending on stack space exhaustion behavior or the lack of tailcall optimizations in the     runtime/engine. See this blog post for details. Impact: Thank you, to Andrew MacPherson (AndrewMohawk) for     identifying & aaron_vercel for reporting this vulnerability and thank you mcollina for fixing it.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1404 advisory.

    Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

    A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers     allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from     previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption.

    While exploitation typically requires precise timing or in-process code execution, it can become remotely     exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality     and integrity impact. (CVE-2025-55131)

    fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

    Memory leak that enables remote Denial of Service against applications processing TLS client certificates     (CVE-2025-59464)

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

    Uncatchable Maximum call stack size exceeded error on Node.js via async_hooks leads to process crashes     bypassing error handlers (CVE-2025-59466)

    TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

    NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-     exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

    Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the     decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert     thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability     is fixed in 7.18.0 and 6.23.0. (CVE-2026-22036)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5cd409edfa advisory.

    Update to version 24.13.0




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f601b2f60a advisory.

    Update to version 20.20.0

    ----

    Update to version 20.19.6




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cc863e84da advisory.

    Update to version 24.13.0.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
297446	Fedora 42 : nodejs22 (2026-b7ad50870e)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	medium
297452	Fedora 43 : nodejs22 (2026-8663c5f961)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	medium
283720	Linux Distros Unpatched Vulnerability : CVE-2025-59464	Nessus	Misc.	1/14/2026	4/29/2026	high
297445	Fedora 42 : nodejs20 (2026-fb4878551d)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	medium
306328	SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:1299-1)	Nessus	SuSE Local Security Checks	4/14/2026	4/14/2026	high
282656	Node.js 20.x < 20.20.0 / 22.x < 22.22.0 / 24.x < 24.13.0 / 24.x < 24.13.0 / 25.x < 25.3.0 Multiple Vulnerabilities (Tuesday, January 13, 2026 Security Releases).	Nessus	Misc.	1/13/2026	4/30/2026	medium
298098	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1404)	Nessus	Amazon Linux Local Security Checks	2/5/2026	4/3/2026	medium
297441	Fedora 43 : nodejs24 (2026-5cd409edfa)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	medium
297442	Fedora 43 : nodejs20 (2026-f601b2f60a)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	high
297444	Fedora 42 : nodejs24 (2026-cc863e84da)	Nessus	Fedora Local Security Checks	1/31/2026	4/3/2026	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

high

medium

medium

medium

high

medium