CVE-2026-105482

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Its dns module offers dns.lookup(), which uses the operating system's resolver, and the dns.resolve*() family and dns.reverse(), which query DNS servers directly through c-ares, a C library that Node.js bundles. Both take names as JavaScript strings and hand them to native bindings written in C++, which pass them on as C strings that end at the first NUL byte.

A hostname confusion vulnerability (CVE-2026-105482) has been identified in Node.js's DNS resolver functions. A name passed to a resolver is supposed to be the name that is queried, so the records an application acts on belong to the name it checked. The fix for CVE-2026-48930 made dns.lookup() and the net and tls host options reject hostnames containing a NUL byte. However, the dns.resolve*() functions and dns.reverse() still accepted them. Resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error, so an application can act on records for a different name than the one it validated.

This behaviour maps to CWE-284 (Improper Access Control), the weakness assigned in the CVE record, where a product does not correctly restrict access to a resource from an unauthorized actor. In Node.js, the controls at risk are the application's own domain allowlists and name checks, which inspect the full string while the DNS query goes to the truncated one. Records returned for the attacker's name can then steer connections, mail delivery or service discovery to an attacker's host.

Exploitation requires an application that takes a hostname from untrusted input, checks it in JavaScript, and then resolves it with dns.resolve(), one of the dns.resolve4()-style methods, dns.reverse(), or their dns.promises and Resolver equivalents. The attacker supplies a name with an embedded NUL byte so that the checked string and the queried prefix differ. Applications that only resolve fixed or already-validated names are not exposed, and applications that only use dns.lookup() or net.connect() were covered by the CVE-2026-48930 fix. The Node.js project describes the issue as affecting its supported 22.x, 24.x and 26.x lines. The resolver functions have only ever checked that the name is a string, so every earlier release line is affected as well, including the 12.x through 20.x lines and builds that already carry the CVE-2026-48930 fix.

Details

Module Info

• Product: Node.js
• Affected packages: node (built-in dns module; lib/internal/dns/callback_resolver.js, lib/internal/dns/promises.js, lib/internal/dns/utils.js)
• Affected versions: <=21.7.3, >=22.0.0 <22.23.4, >=23.0.0 <=23.11.1, >=24.0.0 <24.22.1, >=25.0.0 <=25.9.0, >=26.0.0 <26.12.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.23.4, 24.22.1, and 26.12.1; Node.js NES v12.22.21, v14.21.14, v16.20.15, v18.20.20, v20.20.5, v20.20.13, and v22.23.5

Vulnerability Info

This High-severity vulnerability is found in the name validation of the dns.resolve*() functions and dns.reverse() in Node.js's dns module (lib/internal/dns/callback_resolver.js and lib/internal/dns/promises.js). The HackerOne CNA scores it 7.4 (CVSS v3.0), and the Node.js project also rates it High. NVD has not yet scored it.

Every resolver method, on dns, dns.promises and Resolver instances, is built by one factory function that validates the name and hands it to a c-ares query wrapper. Before handing the name on, the method is supposed to make sure the native layer will query the same name the caller supplied. In the vulnerable implementation, it only checked that the name was a string.

A value containing a NUL byte passed this check. The C++ binding converts it to a C string, so c-ares queried only the part before the NUL and returned those records as if they answered the full name. dns.reverse() is built by the same factory, so an address such as 127.0.0.1\0.trusted.example was reverse-resolved as 127.0.0.1. Resolver.setLocalAddress() had the same gap for the local bind addresses it accepts. The fix replaces these checks with validateStringWithoutNullBytes(), which throws ERR_INVALID_ARG_VALUE for any name containing a NUL byte, the same check CVE-2026-48930 added to dns.lookup().

An attacker would need to get a hostname with an embedded NUL byte into an application that validates the full string before resolving it. One example is a service that checks a user-supplied domain against an allowlist and then looks up its MX, TXT or SRV records.

Note: Because the NUL byte must reach the resolver intact, applications that only resolve hostnames parsed and normalized by a URL parser that rejects or percent-encodes NUL bytes may not be reachable. This depends on how each application builds the name.

Mitigation

Node.js 22.x, 24.x and 26.x are supported and are fixed in 22.23.4, 24.22.1 and 26.12.1 and later. Every other release line is past its support window and never received an upstream fix. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 20.x on April 30, 2026; Node.js 21.x on June 1, 2024; Node.js 23.x on June 1, 2025; and Node.js 25.x on June 1, 2026. For more information see the Node.js previous releases schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 or later on those lines, all of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Hasan Flayyih Abdullah (reporter)
• jasnell (remediation developer)