Threats tagged 'bit-node-2026-105482'

A vulnerability in Node.js DNS resolution functions allows hostnames containing a NUL byte to be silently truncated by dns.resolve*() and dns.reverse(). This can cause applications that validate hostnames but then resolve them using these functions to act on DNS records for a different hostname than intended. The flaw affects Node.js versions 22.x, 24.x, and 26.x prior to specific fixed releases.