CVE-2026-123587 is a vulnerability in the Hickory net DNSSEC validation component where the last NSEC record in a zone points back to the zone apex. The DNSSEC validator incorrectly trusts an unvalidated SOA record when the NSEC record's next domain name equals the SOA record's owner name, allowing an attacker who can modify DNS responses to forge responses that make the validator incorrectly conclude that certain domain names do not exist. This affects versions >=0.26.0 and <0.26.2 and is fixed in version 0.26.2.