The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47059 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48033 advisory.

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48034 advisory.

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47060 advisory.

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47059 advisory.

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47057 advisory.

    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47060 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48033 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47060 advisory.

    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47059 advisory.

    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-193842 RHEL-193874 RHEL-208661
    - Update to version 22.23.1       Resolves: RHEL-176170       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338
    - Update to version 22.22.2       Resolves: RHEL-154019       Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528
    - Patch fix for sqlite CVE-2025-6965       Resolves: RHEL-103835
    - Update to 22.16.0       Fixes: CVE-2025-23166
    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87300
    - Update c-ares to newest version with fix for CVE-2025-31498       Resolves: RHEL-86581

    nodejs-nodemon
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469
    - Update to 2.0.7 to resolve CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48034 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory.

    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-212550 RHEL-193849 RHEL-193891 RHEL-208680
    - Update to version 22.23.1       Resolves: RHEL-186622 RHEL-185998 RHEL-183669       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338
    - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
    - patch for npm/braces CVE-2026-25547       Resolves: RHEL-163370       Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904     CVE-2026-26996 CVE-2026-25547
    - Patch fix for CVE-2025-6965       Resolves: RHEL-103853
    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87320
    - Update c-ares to newest version with fix for CVE-2025-31498       Resolves: RHEL-86587

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
330450	RHEL 8 : nodejs:22 (RHSA-2026:47059)	Nessus	Red Hat Local Security Checks	7/28/2026	7/28/2026	critical
331481	RockyLinux 10 : nodejs22 (RLSA-2026:48033)	Nessus	Rocky Linux Local Security Checks	7/31/2026	7/31/2026	critical
331482	RockyLinux 10 : nodejs24 (RLSA-2026:48034)	Nessus	Rocky Linux Local Security Checks	7/31/2026	7/31/2026	critical
330455	RockyLinux 8 : nodejs:24 (RLSA-2026:47060)	Nessus	Rocky Linux Local Security Checks	7/28/2026	7/29/2026	critical
330517	RockyLinux 8 : nodejs:22 (RLSA-2026:47059)	Nessus	Rocky Linux Local Security Checks	7/29/2026	7/29/2026	critical
331543	Oracle Linux 9 : nodejs:24 (ELSA-2026-47057)	Nessus	Oracle Linux Local Security Checks	8/1/2026	8/1/2026	critical
330426	RHEL 8 : nodejs:24 (RHSA-2026:47060)	Nessus	Red Hat Local Security Checks	7/28/2026	7/28/2026	critical
330683	RHEL 10 : nodejs22 (RHSA-2026:48033)	Nessus	Red Hat Local Security Checks	7/29/2026	7/29/2026	critical
325958	Linux Distros Unpatched Vulnerability : CVE-2026-59873	Nessus	Misc.	7/9/2026	7/30/2026	critical
331588	Oracle Linux 8 : nodejs:24 (ELSA-2026-47060)	Nessus	Oracle Linux Local Security Checks	8/1/2026	8/1/2026	critical
331585	Oracle Linux 8 : nodejs:22 (ELSA-2026-47059)	Nessus	Oracle Linux Local Security Checks	8/1/2026	8/1/2026	critical
330862	RHEL 10 : nodejs24 (RHSA-2026:48034)	Nessus	Red Hat Local Security Checks	7/30/2026	7/30/2026	critical
331538	Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)	Nessus	Oracle Linux Local Security Checks	8/1/2026	8/1/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical