Executive brief
Node.js is a popular server-side JavaScript runtime used to build web applications and services. A flaw in the dns.resolveAny() function causes the Node.js process to crash when a DNS response contains more than 256 A records. An attacker who can control DNS responses to an application can repeatedly trigger this crash, causing service unavailability (denial of service).
Technical details
A buffer overflow or assertion failure in the dns.resolveAny() DNS resolver function in Node.js causes process abort when processing DNS responses with more than 256 A records. The vulnerability is triggered via a malicious or crafted DNS response that an application queries—no authentication is required and the attack is network-accessible. An attacker can repeatedly send such DNS responses to cause repeated process crashes and sustained denial of service. Patches are available in Node.js 26.x, 24.x, and 22.x release lines.
Affected products
- OpenJS Foundation Node.js 26.x, 24.x, 22.x
Timeline
- 2026-07-29: disclosed: Security release published
- 2026-07-29: patched: Patches available for 26.x, 24.x, 22.x