All vulnerabilities
CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which o

nodejs nodeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 23 Oct 2026, 16:15 UTCPublishedCVE List
  2. 23 Oct 2026, 21:25 UTCFirst reportBluesky: CVE posts
  3. 23 Oct 2026, 23:46 UTCExploit code publicGitHub proof-of-concept repositories

Reports 2

2 outlets mention it. Reports are not confirmation; each links to its source.

Description

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Text from CVE List

Affected versions 3

  • nodeaffected: 22.23.3 through 22.23.3CVE List
  • nodeaffected: 24.22.0 through 24.22.0CVE List
  • nodeaffected: 26.12.0 through 26.12.0CVE List

References 1