BIT-node-2026-105482: High severity bitnami/node vulnerability

Q: Which applications are realistically exposed to this issue?

Applications are exposed if they validate hostnames, such as against a domain allowlist, and then pass those names to dns.resolve*() or dns.reverse(). A hostname containing a NUL byte can pass validation as one name while DNS resolution is performed for the truncated name.

Q: What does an attacker need to exploit the flaw?

An attacker needs to supply or influence a hostname used by the application and include a NUL byte followed by another domain component. The application must validate the full supplied hostname and subsequently resolve it using an affected DNS API.

Q: Are all Node.js DNS lookups affected?

The described issue affects dns.resolve*() functions and dns.reverse(). CVE-2026-48930 had covered dns.lookup() and net/tls host options, but this issue concerns the remaining NUL-byte handling in the listed DNS APIs.

Q: How can teams determine whether their application is affected?

Review code paths that accept hostnames from untrusted or indirectly controlled sources, enforce hostname or domain allowlists, and then call dns.resolve*() or dns.reverse(). Affected behavior occurs when a name such as attacker.example followed by a NUL byte and trusted.example resolves records for attacker.example without an error.

Published Oct 29, 2026

Updated

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

6 affected componentsFixes available

bitnami/node<22.23.4

22.23.4

bitnami/node>=23.0.0<24.22.1

24.22.1

bitnami/node>=25.0.0<26.12.1

26.12.1

bitnami/node-min<22.23.4

22.23.4

bitnami/node-min>=23.0.0<24.22.1

24.22.1

bitnami/node-min>=25.0.0<26.12.1

26.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node to a version that resolves this vulnerability.
Fixed in 26.12.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 22.23.4
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 24.22.1
Upgrade
Upgrade bitnami/node-min to a version that resolves this vulnerability.
Fixed in 26.12.1

Event History

Oct 29, 2026

Advisory Published

via OSV·08:55 AM

Data Sourced

via OSV·08:55 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications are exposed if they validate hostnames, such as against a domain allowlist, and then pass those names to dns.resolve*() or dns.reverse(). A hostname containing a NUL byte can pass validation as one name while DNS resolution is performed for the truncated name.

What does an attacker need to exploit the flaw?

An attacker needs to supply or influence a hostname used by the application and include a NUL byte followed by another domain component. The application must validate the full supplied hostname and subsequently resolve it using an affected DNS API.

Are all Node.js DNS lookups affected?

The described issue affects dns.resolve*() functions and dns.reverse(). CVE-2026-48930 had covered dns.lookup() and net/tls host options, but this issue concerns the remaining NUL-byte handling in the listed DNS APIs.

How can teams determine whether their application is affected?

Review code paths that accept hostnames from untrusted or indirectly controlled sources, enforce hostname or domain allowlists, and then call dns.resolve*() or dns.reverse(). Affected behavior occurs when a name such as attacker.example followed by a NUL byte and trusted.example resolves records for attacker.example without an error.

BIT-node-2026-105482: High severity bitnami/node vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

Are all Node.js DNS lookups affected?

How can teams determine whether their application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the flaw?

Are all Node.js DNS lookups affected?

How can teams determine whether their application is affected?