Node.js Module Undici 7.17.x < 7.24.0 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(309958);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2026-2581");
  script_xref(name:"IAVB", value:"2026-B-0072");

  script_name(english:"Node.js Module Undici 7.17.x < 7.24.0 DoS");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The nodejs module Undici detected on the host is version 7.17.x prior to 7.24.0. It is, therefore, affected by a
denial of service vulnerability. When the deduplication interceptor is enabled, response data for deduplicated requests
is accumulated in memory for downstream handlers. An unauthenticated, remote attacker can exploit this, via large or
chunked responses and concurrent identical requests, to cause high memory usage and potential process termination.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3df7c949");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Undici version 7.24.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-2581");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:undici:undici");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'undici');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'undici');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '7.17.0', 'fixed_version': '7.24.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);