Search: CVE-2026-105482

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain an improper access control vulnerability in DNS resolution functions. Hostnames with embedded NUL bytes are truncated silently by dns.resolve*() and dns.reverse(), allowing resolution of unintended hostnames. This flaw is a partial fix of a previous vulnerability affecting dns.lookup(). Applications validating hostnames before resolution may be tricked into acting on DNS records for different names than those validated.