CVE-2026-105482
published 2026-10-23CVE-2026-105482: A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…
PriorityP344high7.4CVSS 3.0
AVNACHPRNUINSUCHIHAN
EPSS
0.42%
36.4th percentile
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | node | 22.23.3 – 22.23.3 | — |
| nodejs | node | 24.22.0 – 24.22.0 | — |
| nodejs | node | 26.12.0 – 26.12.0 | — |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
CVSS provenance
nvdv3.07.4HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Node.js prior 22.23.3/24.22.0/26.12.0 DNS Resolution dns.reverse name input validation
vuldb·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] Node.js prior 22.23.3/24.22.0/26.12.0 DNS Resolution dns.reverse name input validation
A vulnerability, which was classified as critical, was found in Node.js. This affects the function dns.reverse of the component DNS Resolution. The manipulation of the argument Name results in improper input validation.
This vulnerability is cataloged as CVE-2026-105482. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
ghsa_unreviewed·2026-10-23·CVSS 9.8
CVE-2026-105482 [CRITICAL] CWE-284 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Red Hat
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
vendor_redhat·2026-10-21·CVSS 7.4
CVE-2026-105482 [HIGH] CWE-158 nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw was found in the Node.js DNS resolver APIs. Hostnam
Fortinet
Multiple Node.js CVEs
vendor_fortinet·CVSS 6.5
CVE-2026-105482 [MEDIUM] Multiple Node.js CVEs
FG-IR-26-187: Multiple Node.js CVEs
CVSSv3 Score:
9.8
CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
CVE-2026-105482 nodejs22: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
CVE-2026-105482 nodejs24: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
CVE-2026-105482 nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Bugzilla
CVE-2026-105482 nodejs26: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
bugzilla·2026-10-23·CVSS 7.4
CVE-2026-105482 [HIGH] CVE-2026-105482 nodejs26: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
CVE-2026-105482 nodejs26: nodejs: dns.resolve truncates hostnames containing a NUL character [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Hackernews
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
blogs_hackernews·2026-10-22
CVE-2026-106069 Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.
Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix
2026-10-23
Published