Node.js Module Undici < 6.24.0 / 7.x < 7.24.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(309957);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2026-1525", "CVE-2026-1526", "CVE-2026-1527");
  script_xref(name:"IAVB", value:"2026-B-0072");

  script_name(english:"Node.js Module Undici < 6.24.0 / 7.x < 7.24.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The nodejs module Undici detected on the host is prior to version 6.24.0 or version 7.x prior to 7.24.0. It is,
therefore, affected by multiple vulnerabilities :

  - A flaw exists due to allowing duplicate HTTP Content-Length headers when provided in an array with
    case-variant names. An unauthenticated, remote attacker can exploit this to cause denial of service
    or to perform HTTP request smuggling attacks leading to ACL bypass, cache poisoning, or credential
    hijacking. (CVE-2026-1525)

  - A flaw exists in the WebSocket client due to unbounded memory consumption during permessage-deflate
    decompression. An unauthenticated, remote attacker can exploit this, via a decompression bomb, to
    cause denial of service. (CVE-2026-1526)

  - A flaw exists due to insufficient validation of the upgrade option in client.request(). An
    authenticated, remote attacker can exploit this, via CRLF injection, to inject arbitrary HTTP headers
    or smuggle raw data to non-HTTP services. (CVE-2026-1527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4763b3d0");
  # https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d67a3133");
  # https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ee2fe1e5");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Undici version 6.24.0 / 7.24.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-1525");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:undici:undici");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'undici');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'undici');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'fixed_version': '6.24.0'},
  {'min_version': '7.0.0', 'fixed_version': '7.24.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);