Node.js -- multiple vulnerabilities

Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS certificate hostname bypass when the IP is written fullwidth digits CVE-2026-105483 - high TLS certificate hostname bypass when the host loosely resolves to an IP address CVE-2026-106069 - high Node.js...

Malicious code in siriusbeyond (npm)

Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically. callback.js collects hostname, username, platform, cwd, home...

Node.js: dns.resolve truncates names containing NUL char

A patch for CVE-2026-48930 was found to be incomplete. The fix rejected embedded NUL bytes in DNS lookup entry points but failed to apply the same validation to dns.resolve entry points that interface with c-ares binding. When a NUL character was passed within a hostname to dns.resolve4, the call...