CVE-2026-58042: Medium severity OpenJS Node.js vulnerability
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58042?
CVE-2026-58042 has a medium severity rating of 5.9.
How do I fix CVE-2026-58042?
To address CVE-2026-58042, upgrade to a patched version of Node.js that is not affected by this vulnerability.
What impact does CVE-2026-58042 have on my Node.js application?
CVE-2026-58042 can cause a denial of service due to the Node.js process aborting when too many A records are received in a DNS response.
Which versions of Node.js are affected by CVE-2026-58042?
CVE-2026-58042 affects Node.js versions 26.x, 24.x, and 22.x.
What should I do if I cannot upgrade Node.js to fix CVE-2026-58042?
If upgrading is not possible, consider implementing additional monitoring and rate-limiting on DNS requests to mitigate the effects of CVE-2026-58042.