The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4537 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223678, BZ#2223680,     BZ#2223682, BZ#2223684, BZ#2223686, BZ#2223688)

    Security Fix(es):

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4536 advisory.

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3306-1 advisory.

    - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150).
    - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire()     (bsc#1214156).
    - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
    - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574).
    - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4537 advisory.

    - Rebase to 16.20.1       Resolves: rhbz#2188289       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5533 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (16.20.2).

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236435, BZ#2178078, BZ#2223335)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3776 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3776-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     March 26, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nodejs     Version        : 10.24.0~dfsg-1~deb10u4     CVE ID         : CVE-2023-30590 CVE-2023-46809 CVE-2024-22025     Debian Bug     : 1039990 1064055

    Vulnerabilities have been found in Node.js, which could lead to denial     of service or information disclosure.

    CVE-2023-30590

        Ben Smyth reported an inconsistency between implementation and         documented design of the The generateKeys() API function, which         only generates missing (or outdated) keys, that is, it only         generates a private key if none has been set yet.
        The documented behavior has been updated to reflect the current         implementation.

    CVE-2023-46809

        It was discovered that Node.js was vulnerable to the Marvin Attack,         allowing a covert timing side-channel during PKCS#1 v1.5 padding         error handling.  An attacker could remotely exploit the         vulnerability to decrypt captured RSA ciphertexts or forge         signatures, especially in scenarios involving API endpoints         processing Json Web Encryption messages.
        The fix disables RSA_PKCS1_PADDING for crypto.privateDecrypt(), and         includes a security revert flag that can be used to restore support         (and the vulnerability).

    CVE-2024-22025

        It was discovered that Node.js was vulnerable to Denial of Service         by resource exhaustion in fetch() brotli decoding.

    For Debian 10 buster, these problems have been fixed in version     10.24.0~dfsg-1~deb10u4.

    We recommend that you upgrade your nodejs packages.

    For the detailed security status of nodejs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nodejs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2663-1 advisory.

    Update to version 16.20.1:

    - CVE-2023-30581: Fixed mainModule.__proto__ Bypass Experimental Policy Mechanism (bsc#1212574).
    - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js     installer repair process (bsc#1212579).
    - CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates     (bsc#1212581).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
    - CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
    - CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE     (bsc#1211607).
    - CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
    - CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
    - CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

    Bug fixes:

    - Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build     failures on some platforms, like s390x in Factory. (bsc#1211407)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2669-1 advisory.

    Update to version 18.16.1:

    - CVE-2023-30581: Fixed mainModule.__proto__ Bypass Experimental Policy Mechanism (bsc#1212574).
    - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js     installer repair process (bsc#1212579).
    - CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates     (bsc#1212581).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
    - CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
    - CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE     (bsc#1211607).
    - CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
    - CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
    - CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).
    - CVE-2022-25881: Fixed a Regular Expression Denial of Service (bsc#1208744).

    Bug fixes:

    - Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build     failures on some platforms, like s390x in Factory. (bsc#1211407)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4331 advisory.

    - Rebase to 16.20.1       Resolves: rhbz#2188291       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4331 advisory.

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - ## 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS  This is a security release.  ### Notable     Changes  The following CVEs are fixed in this release:  * [CVE-2023-30581](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__` Bypass Experimental Policy Mechanism (High) *     [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation via     Malicious Registry Key manipulation during Node.js installer repair process (Medium) *     [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due     to invalid Public Key information in x509 certificates (Medium) *     [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling     via Empty headers separated by CR (Medium) * [CVE-2023-30590](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not generate keys after setting a private key     (Medium) * OpenSSL Security Releases   * [OpenSSL security advisory 28th     March](https://www.openssl.org/news/secadv/20230328.txt).   * [OpenSSL security advisory 20th     April](https://www.openssl.org/news/secadv/20230420.txt).   * [OpenSSL security advisory 30th     May](https://www.openssl.org/news/secadv/20230530.txt) * c-ares vulnerabilities:   *     [GHSA-9g78-jv2r-p7vc](https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc)   *     [GHSA-8r8p-23f3-64c2](https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2)   *     [GHSA-54xr-f67r-4pc4](https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4)   *     [GHSA-x6mf-cxr9-8q6v](https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v)  More     detailed information on each of the vulnerabilities can be found in [June 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/) blog post.
    (CVE-2023-30581, CVE-2023-30588, CVE-2023-30590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4536 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631,     BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)

    Security Fix(es):

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:18/nodejs: Don't assume FIPS is disabled by default [rhel-8] (BZ#2223639)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4537 advisory.

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - ## 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS  This is a security release.  ### Notable     Changes  The following CVEs are fixed in this release:  * [CVE-2023-30581](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__` Bypass Experimental Policy Mechanism (High) *     [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation via     Malicious Registry Key manipulation during Node.js installer repair process (Medium) *     [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due     to invalid Public Key information in x509 certificates (Medium) *     [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling     via Empty headers separated by CR (Medium) * [CVE-2023-30590](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not generate keys after setting a private key     (Medium) * OpenSSL Security Releases   * [OpenSSL security advisory 28th     March](https://www.openssl.org/news/secadv/20230328.txt).   * [OpenSSL security advisory 20th     April](https://www.openssl.org/news/secadv/20230420.txt).   * [OpenSSL security advisory 30th     May](https://www.openssl.org/news/secadv/20230530.txt) * c-ares vulnerabilities:   *     [GHSA-9g78-jv2r-p7vc](https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc)   *     [GHSA-8r8p-23f3-64c2](https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2)   *     [GHSA-54xr-f67r-4pc4](https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4)   *     [GHSA-x6mf-cxr9-8q6v](https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v)  More     detailed information on each of the vulnerabilities can be found in [June 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/) blog post.
    (CVE-2023-30581, CVE-2023-30588, CVE-2023-30590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0614 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-45143:
    Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds.

    CVE-2023-39332:
    Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects.

    This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability     follows the same pattern using `Uint8Array` instead of `Buffer`.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2023-38552:
    When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check.
    Impacts:
    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    18.x and, 20.x.
    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    CVE-2023-32559:
    A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-32006:
    The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module.

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x, and, 20.x.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-32002:
    The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    CVE-2023-30590:
    The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values.

    The documented behavior is very different from the actual behavior, and this difference could easily lead     to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for     application-level security, implications are consequently broad.

    CVE-2023-30588:
    When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

    CVE-2023-30581:
    The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

    CVE-2023-39333:
    Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module.

    CVE-2023-23918:
    A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy.

    CVE-2023-23920:
    An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.

    CVE-2022-25881:
    This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library.

    CVE-2023-23919:
    A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service.

    CVE-2023-30589:
    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According     to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js     active versions: v16, v18, and, v20

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0204 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-30581:
      No description is available for this CVE.

      CVE-2023-30588:
      No description is available for this CVE.

      CVE-2023-30589:
      The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS).
      The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser.
    According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all     Node.js active versions: v16, v18, and, v20

      CVE-2023-30590:
      No description is available for this CVE.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6295:01 advisory.

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
      * nodejs: process interuption due to invalid Public Key information in x509 certificates     (CVE-2023-30588)
      * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
      * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
179474	RHEL 8 : nodejs:16 (RHSA-2023:4537)	Nessus	Red Hat Local Security Checks	2023/8/8	2024/11/7	high
179625	AlmaLinux 8 : nodejs:18 (ALSA-2023:4536)	Nessus	Alma Linux Local Security Checks	2023/8/9	2025/1/13	high
179823	SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2023:3306-1)	Nessus	SuSE Local Security Checks	2023/8/15	2026/6/26	critical
179855	Oracle Linux 8 : nodejs:16 (ELSA-2023-4537)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2026/2/24	high
182781	RHEL 9 : nodejs (RHSA-2023:5533)	Nessus	Red Hat Local Security Checks	2023/10/9	2024/11/7	critical
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	critical
192597	Debian dla-3776 : libnode-dev - security update	Nessus	Debian Local Security Checks	2024/3/27	2025/1/22	high
177697	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2023:2663-1)	Nessus	SuSE Local Security Checks	2023/6/28	2026/6/25	high
177719	SUSE SLES15 / openSUSE 15 Security Update : nodejs18 (SUSE-SU-2023:2669-1)	Nessus	SuSE Local Security Checks	2023/6/29	2026/6/25	high
179240	Oracle Linux 9 : nodejs (ELSA-2023-4331)	Nessus	Oracle Linux Local Security Checks	2023/8/2	2026/2/24	high
179249	AlmaLinux 9 : nodejs (ALSA-2023:4331)	Nessus	Alma Linux Local Security Checks	2023/8/2	2023/12/5	high
179457	RHEL 8 : nodejs:18 (RHSA-2023:4536)	Nessus	Red Hat Local Security Checks	2023/8/8	2024/11/7	high
179469	Rocky Linux 8 : nodejs:16 (RLSA-2023:4537)	Nessus	Rocky Linux Local Security Checks	2023/8/8	2023/12/5	high
239784	TencentOS Server 4: nodejs (TSSA-2024:0614)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
239903	TencentOS Server 3: nodejs:18 (TSSA-2023:0204)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
292460	MiracleLinux 9 : nodejs:18 (AXSA:2023-6295:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

偵測

搜尋 Plugin

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

critical

high

high