A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 7.4 High.
Data as of 10/25/2026, 12:14:21 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
Description
A vulnerability in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions. This flaw affects version 3.0 of the affected Microsoft product. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
Impact
The impact is limited to potential incorrect DNS resolution due to hostname truncation at the NUL byte. This could cause security controls that depend on hostname validation to be bypassed or misapplied. No evidence of active exploitation or broader impact is reported.
Weaknesses
- CWE-284Improper Access Control (opens in a new tab)
Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.