Zero Radar
← feed
HighVulnerabilityCVE-2026-105482updated 28 Oct 2026, 20:43 UTC

Node.js DNS lookups can silently act on the wrong hostname

Node.js can read a hostname only up to a hidden 'end of text' marker, so a name that looks safe can be checked as one site but looked up as another. Apps that rely on that check could connect to the wrong server.

Fix availableOfficial, 4 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesFixes were announced by Node.js on October 21, 2026 for the 22.x, 24.x and 26.x release lines; the specific patched version numbers are not stated in the provided material. · since 27 Oct 2026
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1Crafted hostnameName includes a hidden NUL byte
  2. 2Validation passesCheck sees the full name
  3. 3dns.resolve truncatesLookup stops at the NUL byte
  4. 4Wrong records usedApp acts on a different hostname
  5. ResultApp trusts records for the wrong host

What happened

Node.js dns.resolve*() and dns.reverse() truncate hostnames containing an embedded NUL byte at the first NUL, because the name is passed to c-ares as a C string. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Why it is dangerous: Applications that validate a hostname (for example against an allowlist) and then resolve it with dns.resolve*() may act on records for a different name than the one they validated, which can lead to traffic going to unintended destinations.

Are you affected?

You are affected if you run Node.js 22.x, 24.x or 26.x and your application validates a hostname and then resolves it using dns.resolve*() or dns.reverse().

Node.js 22.x, 24.x, 26.x

What to do

  1. Update Node.js to the fixed release for your line (22.x, 24.x or 26.x) from the October 21, 2026 Node.js security release
  2. Check whether your code uses dns.resolve*() or dns.reverse() after validating hostnames, and review those code paths
  3. Reject hostnames containing NUL bytes (\0) in input validation until patched
  4. Rebuild and redeploy applications that bundle Node.js, including Cisco or Splunk products that embed it, per vendor advisories

Timeline

  1. 23 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 17:01 UTC
    Fortinet PSIRT reported on it · Fortinet PSIRT
  4. 26 Oct 2026, 17:12 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:32 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  6. 27 Oct 2026, 21:32 UTC
    Fix: Fixes released by Node.js in its October 21, 2026 security release for the 22.x, 24.x and 26.x lines (exact patched versions not stated in the provided material).
  7. 28 Oct 2026, 20:36 UTC
    Reported by Cisco PSIRT · Cisco PSIRT

Sources 5 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105482 · GHSA-4qmx-59c6-fr6r
CVSS
7.4 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 17:17 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 20:43 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Node.js DNS lookups can silently act on the wrong hostname · Zero Radar