TencentOS Server 3: nodejs:22 (TSSA-2026:0931)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0931.
##

include('compat.inc');

if (description)
{
  script_id(341100);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/27");

  script_cve_id(
    "CVE-2026-6733",
    "CVE-2026-9678",
    "CVE-2026-11525",
    "CVE-2026-12151",
    "CVE-2026-42338",
    "CVE-2026-48615",
    "CVE-2026-48618",
    "CVE-2026-48619",
    "CVE-2026-48928",
    "CVE-2026-48930",
    "CVE-2026-48933",
    "CVE-2026-48934",
    "CVE-2026-48935"
  );

  script_name(english:"TencentOS Server 3: nodejs:22 (TSSA-2026:0931)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0931 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-6733:
    Impact:
    Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An
    attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after
    a request completes. When the client dispatches the next request on that socket, it associates the
    injected response with the new request, causing responses to be delivered to the wrong requests.

    This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection
    reuse.

    Patches:
    Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

    Workarounds:
    Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

    CVE-2026-9678:
    Impact:
    Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-
    Control header uses whitespace-padded qualified private or no-cache field names such as private=
    authorization or no-cache=\tauthorization. The parser preserves the surrounding whitespace, so later
    comparisons against the literal authorization field name fail and the response is stored.

    In shared-cache mode, this allows a response containing one user's authenticated data to be served from
    cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same
    cache key.

    Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in
    shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical
    qualified private or no-cache directives.

    Patches:
    Upgrade to undici v7.28.0 or v8.5.0.

    Workarounds:
    If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization
    headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

    CVE-2026-11525:
    Impact:
    When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax,
    or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec
    values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness
    is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from
    Strict).

    Affected applications are those that consume Set-Cookie headers from server responses (for example via
    undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious
    or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value,
    silently degrading the SameSite enforcement the cookie is supposed to provide.

    This was introduced in undici 5.15.0 when the cookies feature was added.

    Patches:
    Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

    Workarounds:
    After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict',
    'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

    CVE-2026-12151:
    Impact:
    The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message
    but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many
    small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively
    causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of
    service.

    Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the
    WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket
    endpoint.

    All releases starting at undici 6.17.0 are affected.

    Patches:Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0.Workarounds:
    No workaround is available. The fix must be applied through an upgrade.

    CVE-2026-42338:
    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to
    10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before
    embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6
    constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An
    application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or
    the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This
    vulnerability is fixed in 10.1.1.

    CVE-2026-48615:
    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error
    messages.

    When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and
    captured by logs, diagnostics, or other error consumers.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48618:
    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls
    wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected
    configurations.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48619:
    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could
    lead to an Out of Memory error on the client.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48928:
    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48930:
    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority
    rebinding due to c-string truncation in resolver bindings.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48933:
    A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a
    multiple of 2GiB.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48934:
    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

    CVE-2026-48935:
    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as
    read-only with e.g. --allow-fs-read.

    This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js
    26**.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260931.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48930");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-42338");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:nodejs-packaging");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'nodejs-packaging-2021.06-6.module+el8.10.0+817+2499aee6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nodejs-packaging-bundler-2021.06-6.module+el8.10.0+817+2499aee6', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'nodejs-packaging / nodejs-packaging-bundler');
}