Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2060.
##

include('compat.inc');

if (description)
{
  script_id(337205);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id(
    "CVE-2026-9496",
    "CVE-2026-13149",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729",
    "CVE-2026-50812",
    "CVE-2026-56846",
    "CVE-2026-56847",
    "CVE-2026-56848",
    "CVE-2026-56850",
    "CVE-2026-58039",
    "CVE-2026-58040",
    "CVE-2026-58042",
    "CVE-2026-58043",
    "CVE-2026-58044",
    "CVE-2026-58045",
    "CVE-2026-59873",
    "CVE-2026-59874",
    "CVE-2026-69184"
  );

  script_name(english:"Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits
    exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who
    passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and
    event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the
    recursion work. (CVE-2026-13149)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the
    Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,
    and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,
    stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject
    CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the
    upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is
    unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from
    user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and
    CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,
    7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length
    header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,
    from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can
    return a partial response with a mismatched framing header, close the socket early, and have the retry
    interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as
    proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to
    downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the
    retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder
    that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and
    8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0
    up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and
    entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie
    attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and
    an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications
    that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope
    session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,
    HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,
    7.29.0, and 8.9.0. (CVE-2026-16729)

    A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before
    check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial
    of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches
    sqlite3_value_type() with a NULL sqlite3_value pointer. (CVE-2026-50812)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace
    Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security
    boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while
    nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual
    TLS (mTLS) client identities to be reused across requests configured with different client
    certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected
    configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname
    verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects
    Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than
    256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix
    boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling
    to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects
    Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-
    can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-
    on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce
    hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and
    parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a
    checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make
    no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha
    function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value
    that triggers the function's regex replacement and string-manipulation logic,  causing excessive CPU
    consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2060.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-13149.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15157.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-16728.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-16729.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50812.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56846.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56847.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56848.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56850.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58039.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58040.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58042.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58043.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58044.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-58045.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59873.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-59874.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-69184.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-9496.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update nodejs22 --releasever 2023.12.20260817' or
  or 'dnf update --advisory ALAS2023-2026-2060 --releasever 2023.12.20260817' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-16729");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-59873");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-full-i18n");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-npm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:v8-12.4-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'nodejs22-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debuginfo-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debuginfo-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debugsource-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debugsource-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-devel-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-devel-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-docs-22.23.2-1.amzn2023.0.2', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-full-i18n-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-full-i18n-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-debuginfo-22.23.2-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-debuginfo-22.23.2-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-npm-10.9.8-1.22.23.2.1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-npm-10.9.8-1.22.23.2.1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.2.1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.2.1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nodejs22 / nodejs22-debuginfo / nodejs22-debugsource / etc");
}