CVE-2026-105482: dns.resolve truncates names containing NUL char
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Other sources
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
— Node.Js
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.4Fixed in 24.22.1Fixed in 26.12.1 - Upgrade
Upgrade
azurelinux/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-0 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 22.23.4 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/nodeto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 22.23.4 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 24.22.1 - Upgrade
Upgrade
bitnami/node-minto a version that resolves this vulnerability.Fixed in 26.12.1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.4-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.12.1-r0 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 24.22.1+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Which Node.js releases contain the fix?
The referenced Node.js release announcements identify v22.23.4 and v24.22.1 as releases associated with this issue.