AZL-111035: CVE-2026-105482 affecting package nodejs for versions less than 24.22.1-0

Q: Which applications are realistically exposed to this issue?

Applications are exposed if they validate a user-controlled hostname, such as against a domain allowlist, and then resolve that hostname using dns.resolve*() or dns.reverse(). The validation and resolution can apply to different effective hostnames when the supplied value contains a NUL byte.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to provide a hostname containing a NUL byte in a flow where the application validates the hostname before resolving it with an affected Node.js DNS API. The resolver can then query only the portion before the NUL byte and return records for that different name.

Q: Are all Node.js hostname resolution APIs affected?

The described issue affects dns.resolve*() functions and dns.reverse(). The earlier fix for CVE-2026-48930 covered dns.lookup() and net/tls host options, but did not cover these APIs.

Q: What version should be used to remediate the issue?

For the affected azure-linux/nodejs package, update to version 24.22.1-0 or later. The vulnerability is stated to affect Node.js 26.x, 24.x, and 22.x.

Published Oct 23, 2026

Updated

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

1 affected componentFixes available

azure-linux/nodejs<24.22.1-0

24.22.1-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0
Upgrade
Upgrade nodejs to a version that resolves this vulnerability.
Fixed in 24.22.1-0

Event History

Oct 23, 2026

Advisory Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-105482

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications are exposed if they validate a user-controlled hostname, such as against a domain allowlist, and then resolve that hostname using dns.resolve*() or dns.reverse(). The validation and resolution can apply to different effective hostnames when the supplied value contains a NUL byte.

What does an attacker need to exploit the vulnerability?

An attacker needs to provide a hostname containing a NUL byte in a flow where the application validates the hostname before resolving it with an affected Node.js DNS API. The resolver can then query only the portion before the NUL byte and return records for that different name.

Are all Node.js hostname resolution APIs affected?

The described issue affects dns.resolve*() functions and dns.reverse(). The earlier fix for CVE-2026-48930 covered dns.lookup() and net/tls host options, but did not cover these APIs.

What version should be used to remediate the issue?

For the affected azure-linux/nodejs package, update to version 24.22.1-0 or later. The vulnerability is stated to affect Node.js 26.x, 24.x, and 22.x.

AZL-111035: CVE-2026-105482 affecting package nodejs for versions less than 24.22.1-0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are all Node.js hostname resolution APIs affected?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are all Node.js hostname resolution APIs affected?

What version should be used to remediate the issue?