There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS
    1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-
    certificate policies per hostname, for example stricter admin-only client-cert auth on one host and
    ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the
    TLS 1.2 connection under a different servername and carry its existing authentication to the protected
    host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
    (CVE-2026-123872)

  - A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker
    corrupt process memory. When an application passes an attacker-controlled value such as a request's
    :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a
    buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end
    of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-
    of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This
    vulnerability affects Node.js 26.x and 24.x. (CVE-2026-123828)

  - A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories
    the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in
    recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only
    once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative
    paths at any depth) to the JavaScript callback without checking that each path is covered by the read
    grant. Code running under --permission with an exact read grant on a directory can therefore learn names
    such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and
    timing metadata, not file contents, and requires macOS or Windows plus files created under the watched
    directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123829)

  - An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting
    while data is being compressed. zlib.params() queues a flush and completes its work in that write's
    callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still
    invokes the callback with an error, but the callback ignores its arguments and asserts that the native
    handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream
    internals and bypasses the stream's error event, the params() callback, and the pipeline() callback,
    terminating the process. An application is affected only if it calls deflate.params() while streaming to a
    peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123862)

  - A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,
    over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated
    header buffers to outlive its session: the stream is removed from the session's stream set but never
    detached, so when ~Http2Session() runs the memory accounting is nonzero and the
    CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a
    default http2 server whose handler responds before the request body has ended, which is typical. It is a
    variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still
    tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
    (CVE-2026-123863)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote,     unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback,     OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL     callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed     between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example,     no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL     deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the     deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event.
    This vulnerability affects Node.js 26.x and 24.x. (CVE-2026-126051)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
479024	Alpine: nodejs: security update to 24.22.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/11/12	2026/11/12	high
479024	Alpine: nodejs: security update to 24.22.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/11/12	2026/11/12	high
379530	Linux Distros Unpatched Vulnerability : CVE-2026-126051	Nessus	Misc.	2026/11/12	2026/11/12	high

偵測

搜尋 Plugin

high

high

high