41 matches found
SUSE-SU-2026:5037-1 Security update for nodejs24
This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...
BIT-NODE-MIN-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
BIT-NODE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
Exploit for CVE-2026-105482
Report on Reproducing CVE-2026-105482 Vulnerability I. Bas...
Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3328)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3328 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...
FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...
Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3330)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3330 advisory. A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response...
Node.js 26.x DNS Resolution NUL-Name Truncation
Node.js versions 22.x, 24.x, and 26.x contain a DNS resolution NUL-name truncation flaw in dns.resolve and dns.reverse that may resolve a hostname different from the one an application validated. This archive provides research and remediation details...
Important: nodejs24
Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...
Important: nodejs22
Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...
CVE-2026-105482
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname. Mitigation To mitigat...
ALPINE-CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
AZL-111035 CVE-2026-105482 affecting package nodejs for versions less than 24.22.1-0
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
DEBIAN-CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
UBUNTU-CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...