Node.js 26.x < 26.12.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370488);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id(
    "CVE-2026-106070",
    "CVE-2026-106071"
  );

  script_name(english:"Node.js 26.x < 26.12.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"Node.js - JavaScript run-time environment is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple
vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP header validation.
    (CVE-2026-106070)

  - A Permission Model filesystem over-grant exists via wildcard radix lookup. (CVE-2026-106071)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://nodejs.org/en/blog/vulnerability/october-2026-security-releases/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43909333");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Node.js version 26.12.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-106070");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_win_installed.nbin", "nodejs_installed_nix.nbin", "macosx_nodejs_installed.nbin");
  script_require_keys("installed_sw/Node.js");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Node.js', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '26.0.0', 'fixed_version' : '26.12.1', 'min_granularity' : 3 }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_NOTE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);