Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2059.
##

include('compat.inc');

if (description)
{
  script_id(337228);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id(
    "CVE-2026-13149",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729",
    "CVE-2026-53655",
    "CVE-2026-56846",
    "CVE-2026-56847",
    "CVE-2026-56848",
    "CVE-2026-56850",
    "CVE-2026-58039",
    "CVE-2026-58040",
    "CVE-2026-58041",
    "CVE-2026-58042",
    "CVE-2026-58043",
    "CVE-2026-58044",
    "CVE-2026-58045",
    "CVE-2026-59871",
    "CVE-2026-59873",
    "CVE-2026-59874",
    "CVE-2026-59875"
  );

  script_name(english:"Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2059 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits
    exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who
    passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and
    event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the
    recursion work. (CVE-2026-13149)

    undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to
    before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive,
    such as private set to an empty value, can be stored in the default shared cache and later served to a
    different caller with the same cache key, disclosing private response bodies and headers including Set-
    Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified
    one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending
    on the consumer's error handling, can terminate the process. Both issues affect applications using the
    cache interceptor in shared mode, including the default configuration. The issues are fixed in undici
    7.29.0 and 8.9.0. (CVE-2026-13697)

    undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-
    cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to
    before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters,
    so the cache decision fails to recognize the qualification and the response is stored. In shared-cache
    mode, this lets a response containing one user's authenticated data be served from cache to a later
    caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects
    applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and
    receive cacheable responses with qualified directives padded with whitespace around the equals sign. This
    is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed
    in undici 7.29.0 and 8.9.0. (CVE-2026-14643)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the
    Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,
    and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,
    stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject
    CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the
    upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is
    unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from
    user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and
    CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,
    7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length
    header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,
    from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can
    return a partial response with a mismatched framing header, close the socket early, and have the retry
    interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as
    proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to
    downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the
    retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder
    that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and
    8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0
    up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and
    entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie
    attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and
    an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications
    that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope
    session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,
    HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,
    7.29.0, and 8.9.0. (CVE-2026-16729)

    node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended
    header's size= record (and other PAX overrides) to the next header entry of any type, including
    intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX
    extended header (x) describes the next file entry, not the intermediary extension headers that may sit
    between the x header and the file it annotates. Because node-tar lets the PAX size override the byte
    length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to
    every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed
    tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single
    crafted archive yields a different set of members under node-tar than under the reference tar tools. An
    attacker can use this to hide a member from one parser while it is visible to another, which defeats
    security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner
    that lists entries with one library while a downstream step extracts with another) This vulnerability is
    fixed in 7.5.16. (CVE-2026-53655)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace
    Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security
    boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while
    nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual
    TLS (mTLS) client identities to be reused across requests configured with different client
    certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected
    configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname
    verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects
    Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodesqlite-sqltagstore-
    iterator-replay-can-re-execute-writes-cve-2026-58041---medium (CVE-2026-58041)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than
    256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix
    boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling
    to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects
    Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-
    can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-
    on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit
    PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as
    normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version
    7.5.18. (CVE-2026-59871)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce
    hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and
    parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a
    checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make
    no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL
    bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach
    fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version
    7.5.17. (CVE-2026-59875)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2059.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-13149.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-13697.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-14643.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15157.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-16728.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-16729.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53655.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56846.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56847.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56848.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56850.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58039.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58040.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58041.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58042.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58043.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58044.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58045.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59871.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59873.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59874.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59875.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update nodejs24 --releasever 2023.12.20260817' or
  or 'dnf update --advisory ALAS2023-2026-2059 --releasever 2023.12.20260817' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13697");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-59873");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-full-i18n");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs24-npm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:v8-13.6-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'nodejs24-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-debuginfo-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-debuginfo-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-debugsource-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-debugsource-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-devel-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-devel-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-docs-24.18.1-1.amzn2023.0.2', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-full-i18n-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-full-i18n-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-libs-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-libs-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-libs-debuginfo-24.18.1-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-libs-debuginfo-24.18.1-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs24-npm-11.16.0-1.24.18.1.1.amzn2023.0.2', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-13.6-devel-13.6.233.17-1.24.18.1.1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-13.6-devel-13.6.233.17-1.24.18.1.1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc");
}