Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370490);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id(
    "CVE-2026-111497",
    "CVE-2026-105482",
    "CVE-2026-106069",
    "CVE-2026-106074",
    "CVE-2026-105481",
    "CVE-2026-106072",
    "CVE-2026-106073"
  );

  script_name(english:"Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"Node.js - JavaScript run-time environment is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to
26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026
Security Releases advisory.

  - An out-of-bounds write in the Brotli decoder can permit remote code execution. (CVE-2026-111497)

  - dns.resolve truncates names containing a NUL character. (CVE-2026-105482)

  - TLS certificate hostname verification can be bypassed when the host loosely resolves to an IP address.
    (CVE-2026-106069)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://nodejs.org/en/blog/vulnerability/october-2026-security-releases/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43909333");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Node.js version 22.23.4 / 24.22.1 / 26.12.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-105482");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-111497");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-111497");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_win_installed.nbin", "nodejs_installed_nix.nbin", "macosx_nodejs_installed.nbin");
  script_require_keys("installed_sw/Node.js");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Node.js', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '22.0.0', 'fixed_version' : '22.23.4', 'min_granularity' : 3 },
        { 'min_version' : '24.0.0', 'fixed_version' : '24.22.1', 'min_granularity' : 3 },
        { 'min_version' : '26.0.0', 'fixed_version' : '26.12.1', 'min_granularity' : 3 }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);