53 matches found
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
Node.js dns.resolve*() dns.reverse() Unauthorized Access
The vulnerability in Node.js’s dns.resolve and dns.reverse functions is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...
openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:22210-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22210-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve...
Security update for nodejs22 (important)
openSUSE security update: security update for nodejs22 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22210-1 Rating: important References: bsc1286261 bsc1286561 bsc1286563 bsc1286564 bsc1286565 bsc1286566 bsc1286567 bsc1286570 Cross-References:...
SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:4957-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4957-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482:...
SUSE-SU-2026:5037-1 Security update for nodejs24
This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...
Security update for nodejs24
This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
BIT-NODE-MIN-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
BIT-NODE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
Exploit for CVE-2026-105482
Report on Reproducing CVE-2026-105482 Vulnerability I. Bas...
Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3328 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...
Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3330)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3330 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...
FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...