CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

EUVD-2026-109105

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in the Node.js DNS resolution mechanism allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). Because names are passed to c-ares as C strings, an attacker could use a hostname like attacker.example .trusted.example to bypass vali...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

Node.js: CVE-2026-105482: dns.resolve truncates hostnames containing a NUL byte

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

Node.js Node permissions and access control issues vulnerability

Node.js versions 22.23.3 and earlier, 24.22.0 and earlier, and 26.12.0 and earlier contain a permission and access control vulnerability. This vulnerability arises because hostnames containing NUL bytes during DNS resolution are silently truncated by the dns.resolve function and dns.reverse...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

Node.js: CVE-2026-105482: dns.resolve truncates hostnames containing a NUL byte

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character

A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...

nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character

A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname...

Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - An out-of-bounds write in the Brotli...

Node.js 26.12.0 dns.resolve NUL Byte Truncation

Node.js versions 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1 contain a dns.resolve NUL byte truncation flaw that can bypass host allow-list checks. https://packetstorm.news/download/237016...

SUSE CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - Improper Null Termination in dns.resolve() leading to Hostname Spoofing

Improper Null Termination in dns.resolve leading to Hostname Spoofing vulnerability discovered by hasanfleyah in WordPress npm Node.js versions 22.23.4...

Exploit for CVE-2026-105482

CVE-2026-105482 – Node.js dns.resolve NUL byte truncation...

Improper Neutralization of Null Byte or NUL Character

Overview Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character via the callback- and promise-based dns.resolve APIs in lib/internal/dns/callbackresolver.js and lib/internal/dns/promises.js. An attacker can make an application resolve an unintend...