CVE-2026-105482

Node.js dns.resolve and the dns promises resolver accept names containing NUL characters and pass them to c-ares as C strings, so the queried name is silently truncated at the NUL byte. Fixed in 22.23.4, 24.22.1 and 26.12.1...