A DNSSEC validation flaw in hickory-proto up to version 0.26.0-alpha.1 allowed acceptance of a parent zone's NSEC record at a zone cut as proof of nonexistence for names below the cut or other types at the cut. This is incorrect because such NSEC records only prove the absence of DS records, not the absence of names or other types. An attacker capable of modifying DNS responses could replay these signed parent records to cause denial of existing names in the child zone to be accepted as secure. The issue was fixed in hickory-net 0.26.2, with DNSSEC validation moved to hickory-net starting from hickory-proto 0.26.0-beta.1.