The Hickory DNS project's experimental recursor crate has a vulnerability in its record cache that allows cross-zone DNS cache poisoning. The cache stores DNS records keyed by each record's own name and type rather than by the original query, enabling an attacker controlling a parent zone to inject NS records for sibling zones. This causes recursive queries for the sibling zone to be redirected to the attacker's nameserver. The issue is fixed in hickory-resolver 0.26.0 with a change to response-level caching keyed by the query. Users of affected versions should upgrade to 0.26.0 or later.