CVE-2026-105482: CWE-284 Improper Access Control - Generic in nodejs node

CVE-2026-105482 is an improper access control vulnerability in Node.js DNS resolution. The dns.resolve*() and dns.reverse() functions pass hostnames containing NUL bytes to the c-ares library as C strings, causing truncation at the NUL byte. This results in resolving a different hostname than the one validated by the application, enabling attackers to bypass hostname validation mechanisms. This issue is an incomplete fix of CVE-2026-48930, which only addressed dns.lookup() and net/tls host options. The affected versions are Node.js 22.23.3, 24.22.0, and 26.12.0.

Applications that validate hostnames against domain allowlists and then use dns.resolve*() or dns.reverse() to resolve those hostnames may receive DNS records for a different hostname than the one validated. This can lead to unauthorized access or information disclosure by bypassing hostname validation controls. The CVSS score is 7.4 (high severity), indicating a significant confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid relying solely on dns.resolve*() or dns.reverse() for hostname validation after allowlist checks. Consider additional validation or alternative DNS resolution methods that do not exhibit this truncation behavior.