DNS Resolution Flaw in Node.js Affects Hostname Validation

CVE-2026-105482

What is CVE-2026-105482?

A vulnerability exists in Node.js DNS resolution that allows hostnames containing a NUL byte to be truncated silently by the dns.resolve*() functions and dns.reverse(). This flaw stems from an incomplete fix to a previous vulnerability, specifically failing to address the dns.lookup() function and net/tls host options. It leads to the resolution of manipulated hostnames in a potentially misleading manner, resulting in applications that validate hostnames against domain allowlists resolving to incorrect records. Consequently, applications could process data for an unintended hostname, exposing them to possible security issues.

References