Node.js 20.x < 20.19.4 / 22.x < 22.17.1 / 24.x < 24.4.1 Multiple Vulnerabilities (Tuesday, July 15, 2025 Security Releases).

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242134);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-27209", "CVE-2025-27210");
  script_xref(name:"IAVB", value:"2025-B-0120-S");

  script_name(english:"Node.js 20.x < 20.19.4 / 22.x < 22.17.1 / 24.x < 24.4.1 Multiple Vulnerabilities (Tuesday, July 15, 2025 Security Releases).");

  script_set_attribute(attribute:"synopsis", value:
"Node.js - JavaScript run-time environment is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Node.js installed on the remote host is prior to 20.19.4, 22.17.1, 24.4.1. It is, therefore, affected by
multiple vulnerabilities as referenced in the Tuesday, July 15, 2025 Security Releases advisory.

  - The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This
    implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be
    hashed can generate many hash collisions - an attacker can generate collisions even without knowing the
    hash-seed. While the V8 team does not classify this as a security vulnerability, the Node.js project
    considers it one due to its potential impact in real-world scenarios. Impact: Thank you, to sharp_edged
    for reporting this vulnerability and thank you targos for fixing it. (CVE-2025-27209)

  - An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device
    names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API. Impact: Thank
    you, to oblivionsage for reporting this vulnerability and thank you RafaelGSS for fixing it.
    (CVE-2025-27210)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Node.js version 20.19.4 / 22.17.1 / 24.4.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-27209");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_win_installed.nbin", "nodejs_installed_nix.nbin", "macosx_nodejs_installed.nbin");
  script_require_keys("installed_sw/Node.js");

  exit(0);
}

include('vcf.inc');

var win_local = FALSE;
var os = get_kb_item_or_exit('Host/OS');
if ('windows' >< tolower(os)) win_local = TRUE;

var app_info = vcf::get_app_info(app:'Node.js', win_local:win_local);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '20.0.0', 'fixed_version' : '20.19.4' },
  { 'min_version' : '22.0.0', 'fixed_version' : '22.17.1' },
  { 'min_version' : '24.0.0', 'fixed_version' : '24.4.1' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);