With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

The versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JavaFX (gstreamer)). Supported versions that are affected are Oracle Java SE: 8u441,     8u441-perf; Oracle GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle     GraalVM Enterprise Edition. (CVE-2024-47606)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JavaFX (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u441; Oracle     GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle     GraalVM Enterprise Edition. (CVE-2024-54534)

  - Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Node (Node.js)).     Supported versions that are affected are Oracle GraalVM for JDK: 17.0.14 and 21.0.6. Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle GraalVM for     JDK executes to compromise Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in      unauthorized creation, deletion or modification access to critical data or all Oracle GraalVM for JDK      accessible data as well as unauthorized access to critical data or complete access to all Oracle GraalVM      for JDK accessible data. (CVE-2025-23083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is     created. This is not limited only to workers but also exposes internal workers, where an instance of them     can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability     affects Permission Model users (--permission) on Node.js v20, v22, and v23. (CVE-2025-23083)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e97e5c6ce3 advisory.

    update for nodejs22-22.14.0-2

    ----

    Update to version 22.13.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1613 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1611 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.9. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2025-01, including the following:

  - libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel     after having completed a threaded name resolve. (CVE-2025-0665)

  - With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread     is created. This is not limited only to workers but also exposes internal workers, where an instance     of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This     vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23. (CVE-2025-23083)

  - When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with     the CURLOPT_ACCEPT_ENCODING option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer     overflow would make libcurl perform a buffer overflow. (CVE-2025-0725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-1611 advisory.

    - Upgrade to version 22.13.1       Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76362 RHEL-76897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-1613 advisory.

    - Update to version 22.13.1       Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76354

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1613 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1611 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1611 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1613 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1522 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1443 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:1351 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)
      * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)
      * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-1443 advisory.

    - Update to version 20.18.2       Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76363 RHEL-76554 RHEL-76540

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1443 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1443 advisory.

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-1351 advisory.

    - Update to version 20.18.2       Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76001 RHEL-76146
    - Update to 20.16.0       Fixes: CVE-2024-36137 CVE-2024-22018 CVE-2024-22020
    - Backport nghttp2 patch for CVE-2024-28182
    - Rebase to version 20.12.0       Addresses CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node)       Addresses CVE-2024-25629 (c-ares)
    - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high)
    - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 (medium)
    - Fixes CVE-2023-44487 (nghttp)
    - Fixes CVE-2023-45143, CVE-2023-39331, CVE-2023-39332, CVE-2023-38552, CVE-2023-39333
    - Address CVE-2023-32002, CVE-2023-32004, CVE-2023-32558 (high)
    - Address CVE-2023-32006, CVE-2023-32559 (medium)
    - Address CVE-2023-32005, CVE-2023-32003 (low)
    - Rebase to 18.16.1       Resolves: rhbz#2188290 rhbz#2166926       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
    - Update bundled c-ares to 1.19.1       Resolves: CVE-2022-4904       Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067
    - Resolves: CVE-2022-25881, CVE-2023-23936, CVE-2023-24807
    - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920
    - Rebase to version 18.12.1       Resolves: rhbz#2125580 CVE-2022-43548 CVE-2022-3517
    - Rebase to version 18.9.1       Resolves: CVE-2022-35255 CVE-2022-35256
    - Rebase to version 18.6.0       Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215       Resolves: CVE-2022-29244
    - Resolves: CVE-2021-43616
    - Resolves CVE-2021-32803, CVE-2021-32804, CVE-2021-37701, CVE-2021-37712
    - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
    - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
    - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
    - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
    - Resolves CVE-2021-22918(libuv)
    - Resolves CVE-2021-22883 CVE-2021-22884
    - Fix CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1351 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)

    * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)

    * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-822 advisory.

    Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3,     undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the     output of `Math.random()` can be predicted if several of its generated values are known. If there is a     mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to     leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs     if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do     not issue multipart requests to attacker controlled servers. (CVE-2025-22150)

    With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is     created. This is not limited only to workers but also exposes internal workers, where an instance of them     can be fetched, and its constructor can be grabbed and reinstated for malicious usage.This vulnerability     affects Permission Model users (--permission) on Node.js v20, v22, and v23. (CVE-2025-23083)

    A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY     notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be     terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption     and potential denial of service under certain conditions. (CVE-2025-23085)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-54958ff9e2 advisory.

    Rebase to 20.18.2

    Resolves: CVE-2025-22150 CVE-2025-23085 CVE-2025-23083

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-76fc32d433 advisory.

    Rebase to 20.18.2

    Resolves: CVE-2025-22150 CVE-2025-23085 CVE-2025-23083

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0284-1 advisory.

    Update to 22.13.1:

    - CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)
    - CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)
    - CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-     data request in undici (bsc#1236258)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0237-1 advisory.

    Update to 20.18.2:

    - CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)
    - CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)
    - CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-     data request in undici (bsc#1236258)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0232-1 advisory.

    Update to 20.18.2:

    - CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)
    - CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)
    - CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-     data request in undici (bsc#1236258)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 18.20.6, 20.18.2, 22.13.1, 23.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 21, 2025 Security Releases advisory.

  - A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY     notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be     terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption     and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users     on Node.js v18.x, v20.x, v22.x and v23.x. Impact: Thank you, to newtmitch for reporting this vulnerability     and thank you RafaelGSS for fixing it. (CVE-2025-23085)

  - With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is     created. This is not limited only to workers but also exposes internal workers, where an instance of them     can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability     affects Permission Model users (--permission) on Node.js v20, v22, and v23. Impact: Thank you, to     leodog896 for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-23083)

  - A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the     Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a     result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a     path that does not start with the file separator is treated as relative to the current directory. This     vulnerability affects Windows users of path.join API. Impact: Thank you, to taise for reporting this     vulnerability and thank you tniessen for fixing it. (CVE-2025-23084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234624	Oracle Java SE Multiple Vulnerabilities (April 2025 CPU)	Nessus	Misc.	critical
231030	Linux Distros Unpatched Vulnerability : CVE-2025-23083	Nessus	Misc.	high
216973	Fedora 41 : nodejs22 (2025-e97e5c6ce3)	Nessus	Fedora Local Security Checks	high
216872	RockyLinux 9 : nodejs:22 (RLSA-2025:1613)	Nessus	Rocky Linux Local Security Checks	high
216870	RockyLinux 8 : nodejs:22 (RLSA-2025:1611)	Nessus	Rocky Linux Local Security Checks	high
215200	Tenable Identity Exposure < 3.77.9 Multiple Vulnerabilities (TNS-2025-01)	Nessus	Windows	medium
216484	Oracle Linux 8 : nodejs:22 (ELSA-2025-1611)	Nessus	Oracle Linux Local Security Checks	high
216483	Oracle Linux 9 : nodejs:22 (ELSA-2025-1613)	Nessus	Oracle Linux Local Security Checks	high
216420	AlmaLinux 9 : nodejs:22 (ALSA-2025:1613)	Nessus	Alma Linux Local Security Checks	high
216418	AlmaLinux 8 : nodejs:22 (ALSA-2025:1611)	Nessus	Alma Linux Local Security Checks	high
216402	RHEL 8 : nodejs:22 (RHSA-2025:1611)	Nessus	Red Hat Local Security Checks	high
216401	RHEL 9 : nodejs:22 (RHSA-2025:1613)	Nessus	Red Hat Local Security Checks	high
216381	RHEL 9 : nodejs:20 (RHSA-2025:1522)	Nessus	Red Hat Local Security Checks	high
216378	AlmaLinux 9 : nodejs:20 (ALSA-2025:1443)	Nessus	Alma Linux Local Security Checks	high
216377	AlmaLinux 8 : nodejs:20 (ALSA-2025:1351)	Nessus	Alma Linux Local Security Checks	high
216340	Oracle Linux 9 : nodejs:20 (ELSA-2025-1443)	Nessus	Oracle Linux Local Security Checks	high
216333	RHEL 9 : nodejs:20 (RHSA-2025:1443)	Nessus	Red Hat Local Security Checks	high
216307	RockyLinux 9 : nodejs:20 (RLSA-2025:1443)	Nessus	Rocky Linux Local Security Checks	high
216256	Oracle Linux 8 : nodejs:20 (ELSA-2025-1351)	Nessus	Oracle Linux Local Security Checks	high
216185	RHEL 8 : nodejs:20 (RHSA-2025:1351)	Nessus	Red Hat Local Security Checks	high
215033	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-822)	Nessus	Amazon Linux Local Security Checks	high
214868	Fedora 40 : nodejs20 (2025-54958ff9e2)	Nessus	Fedora Local Security Checks	high
214858	Fedora 41 : nodejs20 (2025-76fc32d433)	Nessus	Fedora Local Security Checks	high
214784	SUSE SLES15 / openSUSE 15 Security Update : nodejs22 (SUSE-SU-2025:0284-1)	Nessus	SuSE Local Security Checks	high
214633	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2025:0237-1)	Nessus	SuSE Local Security Checks	high
214632	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2025:0232-1)	Nessus	SuSE Local Security Checks	high
214404	Node.js 18.x < 18.20.6 / 20.x < 20.18.2 / 22.x < 22.13.1 / 23.x < 23.6.1 Multiple Vulnerabilities (Tuesday, January 21, 2025 Security Releases).	Nessus	Misc.	high

Detections

Analytics

CVE-2025-23083

high

Tenable Plugins

critical

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high