CVE-2026-58042: dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Other sources
A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than 256 A records.
Repeated triggering of this condition can lead to denial of service.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 27.0.0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.2-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.18.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 26.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-58042?
CVE-2026-58042 has a medium severity rating of 5.9.
How do I fix CVE-2026-58042?
To address CVE-2026-58042, upgrade to a patched version of Node.js that is not affected by this vulnerability.
What impact does CVE-2026-58042 have on my Node.js application?
CVE-2026-58042 can cause a denial of service due to the Node.js process aborting when too many A records are received in a DNS response.
Which versions of Node.js are affected by CVE-2026-58042?
CVE-2026-58042 affects Node.js versions 26.x, 24.x, and 22.x.
What should I do if I cannot upgrade Node.js to fix CVE-2026-58042?
If upgrading is not possible, consider implementing additional monitoring and rate-limiting on DNS requests to mitigate the effects of CVE-2026-58042.