CVE-2026-105482: Node.js dns.resolve() NUL byte hostname truncation

CVE-2026-105482 · Severity: high · CVSS 7.4 · Published 2026-10-23

Node.js is a runtime environment used to build server applications and tools. The dns.resolve*() functions in Node.js fail to reject hostnames containing NUL characters, causing them to be silently truncated when passed to the DNS resolver. An attacker can craft a hostname like "attacker.example\0.trusted.example" which resolves as "attacker.example", bypassing hostname validation checks that applications perform before DNS resolution, potentially redirecting connections to attacker-controlled servers.

Technologies: OpenJS Foundation Node.js. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-105482 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105482 being exploited in the wild.
How severe is CVE-2026-105482?
High severity, with a CVSS score of 7.4, published 23 October 2026.
Which products and versions are affected?
OpenJS Foundation Node.js 22.x, 24.x, 26.x.
Is there a fix for CVE-2026-105482?
Yes: fixed in Node.js v22.23.4, v24.22.1, v26.12.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105482 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-105482?
Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Node.js v22.23.4, v24.22.1, v26.12.1

Technical details

The vulnerability exists in the dns.resolve*() and dns.reverse() functions, which pass hostnames to the c-ares library as C strings; when a NUL byte is present, the string is truncated at that point without error. This is an incomplete fix of CVE-2026-48930, which only patched dns.lookup() and net/tls host options. Applications that validate hostnames against an allowlist and subsequently resolve them with dns.resolve*() will bypass those validations for the truncated name portion.

Affected products

  • OpenJS Foundation Node.js 22.x, 24.x, 26.x

Timeline

  • 2026-10-21: disclosed
  • 2026-10-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.