Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3328.
##

include('compat.inc');

if (description)
{
  script_id(371902);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/25");

  script_cve_id(
    "CVE-2026-87018",
    "CVE-2026-105481",
    "CVE-2026-105482",
    "CVE-2026-106069",
    "CVE-2026-106072",
    "CVE-2026-106073",
    "CVE-2026-106074",
    "CVE-2026-109383",
    "CVE-2026-109869",
    "CVE-2026-109924",
    "CVE-2026-109932"
  );

  script_name(english:"Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3328 advisory.

    A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was
    written before the corresponding request was sent. This may cause incorrect response association and
    potentially lead to HTTP response confusion or unintended data exposure. (CVE-2026-105481)

    A vulnerability in Node.js allows the `dns.resolve` function to improperly handle domain names containing
    null bytes, potentially causing domain name truncation and inconsistent hostname validation. This could
    allow applications relying on hostname validation to process unintended domain names. The issue affects
    Node.js 22.x, 24.x, and 26.x release lines. Upgrade to a patched version to address the vulnerability.
    (CVE-2026-105482)

    A vulnerability in Node.js TLS certificate hostname validation allows a hostname that loosely resolves to
    an IP address to bypass hostname verification. This may enable an attacker to impersonate a trusted
    endpoint and potentially facilitate man-in-the-middle attacks. (CVE-2026-106069)

    A vulnerability in Node.js TLS certificate validation allows non-canonical IPv4 hostnames to be
    incorrectly matched against DNS Subject Alternative Name (SAN) entries in certificates. This may allow a
    certificate issued for a DNS name to authenticate an IP endpoint, potentially bypassing intended hostname
    validation. (CVE-2026-106072)

    A vulnerability in Node.js causes the entropy caches used by `crypto.randomUUID()` and
    `crypto.randomInt()` to be preserved in user-land startup snapshots and Single Executable Applications
    (SEAs). As a result, multiple processes initialized from the same snapshot may generate repeated values,
    weakening randomness and potentially compromising security mechanisms that rely on unique or unpredictable
    values. (CVE-2026-106073)

    A vulnerability in the Node.js Permission Model allows filesystem access restrictions to be bypassed
    through `fs.realpathSync()`. This may enable an application to access filesystem paths that should be
    restricted by the configured permission policies. (CVE-2026-106074)

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and
    8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone
    before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-
    supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the
    TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject,
    but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the
    default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications
    use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications
    that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key
    pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls
    option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should
    upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead
    of tls, or for proxied destinations use requestTls and proxyTls. (CVE-2026-109383)

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0,
    and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server
    returns a response with more than five content codings and closes the connection before sending the body.
    undici rejects such responses because of a content-encoding limit, but it created the internal response
    stream before that check and returned without attaching an error listener or aborting the request, so the
    early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an
    unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a
    single response, even when the application correctly catches the fetch() rejection, resulting in a denial
    of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of
    those versions or later. There is no workaround. (CVE-2026-109869)

    undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and
    8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or
    compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event
    separator, or a single unfinished line split across many chunks, the parser retains a growing amount of
    per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound,
    and because maxResponseSize is enforced on the compressed body before decompression, a small compressed
    response can expand into enough retained memory to terminate the process. An application only needs to
    maintain an EventSource connection to an untrusted peer, which controls only the response, and
    availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the
    retained parser state independently of the byte limits, and users should upgrade to one of those versions
    or later. There is no workaround. (CVE-2026-109924)

    undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and
    8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be
    driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame
    received, the client automatically writes a PONG response and ignores the backpressure signal from the
    socket write, so a server that streams small PING frames while never reading the client's PONGs makes the
    outbound write queue and heap grow without bound until the Node.js process runs out of memory and
    terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is
    asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the
    only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing
    when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound
    queue, and users should upgrade to one of those versions or later. There is no workaround.
    (CVE-2026-109932)

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and
    8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection
    is established and presents a different, CA-trusted certificate whose hostname does not match the
    requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the
    socket with a certificate-altname error, but undici's established-socket error handler asserted that this
    error code could never occur, so the peer-controlled error became an uncaught assertion that terminates
    the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS
    endpoint reached through undici or the global fetch() can crash the client with a single server-initiated
    renegotiation, taking down all in-flight requests and background work in the process, and exploitation
    needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid
    certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed
    in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a
    workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target
    endpoints support it. (CVE-2026-87018)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3328.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-105481.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-105482.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-106069.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-106072.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-106073.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-106074.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109383.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109869.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109924.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-109932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87018.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update nodejs22 --releasever 2023.12.20261026' or
  or 'dnf update --advisory ALAS2023-2026-3328 --releasever 2023.12.20261026' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-109383");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-full-i18n");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nodejs22-npm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:v8-12.4-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'nodejs22-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debuginfo-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debuginfo-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debugsource-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-debugsource-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-devel-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-devel-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-docs-22.23.4-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-full-i18n-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-full-i18n-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-debuginfo-22.23.4-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-libs-debuginfo-22.23.4-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-npm-10.9.9-1.22.23.4.1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'nodejs22-npm-10.9.9-1.22.23.4.1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.4.1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.4.1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nodejs22 / nodejs22-debuginfo / nodejs22-debugsource / etc");
}