Live › vulnerability › CVE-2026-105482
Go to dashboardNode.js dns.resolve*() and dns.reverse() cut a hostname at the first NUL byte, so a name like attacker.example\0.trusted.example returns records for attacker.example with no error. An application that validates a hostname and then resolves it with these functions can act on records for a different name than the one it checked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running affected Node.js lines that validate a hostname (for example against a domain allowlist) and then resolve it with dns.resolve*() or dns.reverse(). Code that only uses dns.lookup() or the net and tls host options is covered by the earlier CVE-2026-48930 fix, and code that never resolves user-influenced names is unlikely to be exposed.
No product ranges from the sources yet.
node --version and compare against the fixed releases in the advisory (affected lines are 22.x, 24.x and 26.x)dns.resolve, dns.resolve4, dns.resolve6, dns.resolveMx or dns.reverse that take hostnames from user input or from an allowlist check\0) before passing them to dns.resolve*() or dns.reverse()Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · in your agent: get_signal("CVE-2026-105482")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.