CVE-2026-105482
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.0 vectorThis vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | H | High (conditions required) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | H | High |
| Integrity I | H | High |
| Availability A | N | None |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA / hackerone | 3.0 | 7.4 HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| nodejs | node | affected: 22.23.3 … <= 22.23.3 affected: 24.22.0 … <= 24.22.0 affected: 26.12.0 … <= 26.12.0 default: unaffected |
Linux distribution status
Red Hat ↗ important
This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.
Mitigation: To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services.
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| Red Hat Hardened Images | hi/nodejs | not affected | |
| Red Hat Hardened Images | nodejs20 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs22 | affected | |
| Red Hat Hardened Images | nodejs22 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs24 | affected | |
| Red Hat Hardened Images | nodejs24 | not affected | |
| Red Hat Hardened Images | nodejs25 | not affected | |
| Red Hat Enterprise Linux 10 | nodejs26 | affected | |
| Red Hat Hardened Images | nodejs26 | not affected | |
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | affected | |
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | affected | |
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | affected |
Debian ↗
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bookworm | nodejs | open not yet assigned | |
| forky | nodejs | open not yet assigned | |
| sid | nodejs | open not yet assigned | |
| trixie | nodejs | open not yet assigned |
Ubuntu ↗ medium
| Release | Package | Status | Fixed version / notes |
|---|---|---|---|
| bionic | nodejs | needs-triage | |
| focal | nodejs | needs-triage | |
| jammy | nodejs | needs-triage | |
| noble | nodejs | needs-triage | |
| resolute | nodejs | needs-triage | |
| stonking | nodejs | needs-triage | |
| trusty | nodejs | needs-triage | |
| xenial | nodejs | needs-triage |