A vulnerability in hickory-proto versions 0.25.0 through 0.26.0-alpha.1 causes incorrect DNSSEC validation due to inverted comparison logic on the last NSEC3 record in a zone's hash chain. This flaw allows an attacker capable of answering or modifying DNS responses to replay certain records and forge proofs that existing DNS names have no records. The issue was fixed starting with hickory-net 0.26.2, which is used from hickory-proto 0.26.0-beta.1 onward.