{"id":"CVE-2026-105482","kind":"vulnerability","aliases":["CVE-2026-105482"],"related":[],"title":"Node.js: DNS resolve functions silently truncate hostnames at NUL bytes","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"Node.js dns.resolve*() and dns.reverse() cut a hostname at the first NUL byte, so a name like attacker.example\\0.trusted.example returns records for attacker.example with no error. An application that validates a hostname and then resolves it with these functions can act on records for a different name than the one it checked.","severity":"high","cvss":7.4,"epss":0.00366,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["allowlist","node.js","poc-public","runtime","server-side","ssrf"],"not_affected_if":["dns-lookup-only","no-user-supplied-hostnames"],"how_to_check":"- Run `node --version` and compare against the fixed releases in the advisory (affected lines are 22.x, 24.x and 26.x)\n- Search application code for calls to `dns.resolve`, `dns.resolve4`, `dns.resolve6`, `dns.resolveMx` or `dns.reverse` that take hostnames from user input or from an allowlist check\n- unknown whether the sources list the exact patched versions","fix":"- Upgrade Node.js 22.x, 24.x and 26.x to the patched release listed in the Node.js security advisory (exact version unknown from these sources)\n- Until patched, reject hostnames containing a NUL byte (`\\0`) before passing them to dns.resolve*() or dns.reverse()","status":"open","published_at":"2026-10-23T17:17:19+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:25:32+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:25:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 22.x, 24.x and 26.x to the patched release listed in the Node.js security advisory (exact version unknown from these sources)\n- Until patched, reject hostnames containing a NUL byte (`\\0`) before passing them to dns.resolve*() or dns.reverse()","reach":"network","title":"Node.js: DNS resolve functions silently truncate hostnames at NUL bytes","impact":"medium","summary":"Node.js dns.resolve*() and dns.reverse() cut a hostname at the first NUL byte, so a name like attacker.example\\0.trusted.example returns records for attacker.example with no error. An application that validates a hostname and then resolves it with these functions can act on records for a different name than the one it checked.","category":"runtime","nicknames":[],"who_cares":["node.js","server-side","allowlist","ssrf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Allowlist checks are bypassed and records for the wrong host are trusted","analyst_note":"Find the patched Node.js versions in the Node.js security advisory and the NVD entry, and confirm which 22.x, 24.x and 26.x releases are fixed.","how_to_check":"- Run `node --version` and compare against the fixed releases in the advisory (affected lines are 22.x, 24.x and 26.x)\n- Search application code for calls to `dns.resolve`, `dns.resolve4`, `dns.resolve6`, `dns.resolveMx` or `dns.reverse` that take hostnames from user input or from an allowlist check\n- unknown whether the sources list the exact patched versions","needs_analyst":true,"not_affected_if":["dns-lookup-only","no-user-supplied-hostnames"],"who_is_affected":"Applications running affected Node.js lines that validate a hostname (for example against a domain allowlist) and then resolve it with dns.resolve*() or dns.reverse(). Code that only uses dns.lookup() or the net and tls host options is covered by the earlier CVE-2026-48930 fix, and code that never resolves user-influenced names is unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":3510,"output_tokens":771,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105482':13A,16A '-2026':12A,15A,107C '-48930':108C '0.trusted.example':44B,133C '22':182C '24':179C '26':177C 'act':66B,161C 'affect':175C 'allow':84C 'allowlist':17B,153C 'applic':53B,143C 'are':126C 'attacker.example':43B,48B,132C,135C 'byte':10A,38B,89C 'c':125C,129C 'c-are':124C 'check':77B 'contain':86C 'cover':111C 'cut':31B 'cve':11A,14A,106C 'differ':71B,166C 'dns':2A,82C 'dns.lookup':112C 'dns.resolve':28B,96C,159C 'dns.reverse':30B,99C 'domain':152C 'error':51B,142C 'exampl':149C 'first':36B 'fix':104C 'flaw':79C 'function':4A,64B,97C 'host':116C 'hostnam':7A,33B,57B,85C,147C 'incomplet':103C 'like':42B 'name':41B,72B,120C,167C 'net/tls':115C 'node.js':1A,18B,27B,81C,176C 'nul':9A,37B,88C 'one':75B,170C 'option':117C 'pass':122C 'poc':20B 'poc-publ':19B 'public':21B 'queri':134C 'record':46B,68B,139C,163C 'resolut':83C 'resolv':3A,60B,131C,156C 'return':45B,137C 'runtim':22B 'server':24B 'server-sid':23B 'side':25B 'silent':5A,92C 'ssrf':26B 'string':130C 'truncat':6A,93C 'valid':55B,145C,172C 'vulner':174C 'without':140C 'x':178C,180C,183C","nicknames":[],"mitigations":[],"who_affected":"Applications running affected Node.js lines that validate a hostname (for example against a domain allowlist) and then resolve it with dns.resolve*() or dns.reverse(). Code that only uses dns.lookup() or the net and tls host options is covered by the earlier CVE-2026-48930 fix, and code that never resolves user-influenced names is unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"support@hackerone.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-105482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482","severity":null,"published_at":"2026-10-23T17:17:19+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/node-cve-2026-105482-check","url":"https://github.com/CompleteTech-LLC/node-cve-2026-105482-check","severity":null,"published_at":"2026-10-23T23:46:49+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105482","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105482","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2247,"url":"https://github.com/CompleteTech-LLC/node-cve-2026-105482-check","title":"CompleteTech-LLC/node-cve-2026-105482-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-105482: Node.js: DNS resolution NUL-name truncation. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:46:49+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}