A vulnerability in hickory-proto up to version 0.26.0-alpha.1 allows its DNSSEC NSEC validation to incorrectly accept NXDOMAIN responses as secure, even when the response proves the queried name exists as an empty non-terminal. This occurs because the NXDOMAIN response code is not signed, enabling an attacker who can modify DNS responses to convert a genuine signed NODATA response into an accepted NXDOMAIN. The issue was fixed in hickory-net 0.26.2, which is used from hickory-proto 0.26.0-beta.1 onward.