CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

• CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer silently truncate the queried name
• CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by the CVE-2026-48618 fix since els15
• CVE-2026-105481: check for unread data in the OS socket buffer before http.Agent reuses a keep-alive socket and destroy the socket if any

These are all security issues fixed in the corepack24-24.22.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)
• CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)
• CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)
• CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)
• CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)
• CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs22 fixes the following issues:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Changes for nodejs22:

• Update to 22.23.4:
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update sqlite to 3.53.4
• deps: update undici to 6.29.1
• Update to 22.23.3:
• deps: update corepack to 0.36.0
• deps: upgrade npm to 10.9.9
• deps: update icu to 78.3
• deps: update Undici to 6.28.1
• node-api: support SharedArrayBuffer in napi_create_typedarray
• node-api: add napi_create_external_sharedarraybuffer

This update for nodejs24 fixes the following issues:

Security issues fixed:

• CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).
• CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).
• CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).
• CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).
• CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (bsc#1286566).
• CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (bsc#1286567).
• CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).

Non security issue fixed:

• 'npm install -h' output is truncated (bsc#1276224).

Changes for nodejs24:

• Update to 24.22.1:
• crypto: update root certificates to NSS 3.131.1
• deps: update c-ares to 1.34.9
• deps: update timezone to 2026e
• deps: upgrade openssl sources to openssl-3.5.9
• deps: update undici to 7.30.1
• Update to 24.22.0:
• crypto: add crypto.parsePKCS12()
• crypto: discover ciphers and hashes from OpenSSL providers
• crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs
• doc: deprecate Server.prototype._listen2 in node:net
• net: support sending net.BoundSocket to threads and child processes
• perf_hooks: implement SlidingWindowHistogram
• perf_hooks: implement qrde analysis support in Histogram
• perf_hooks: implement Histogram meanCI API
• perf_hooks: add CBOR export/import for histogram exchange
• sqlite: add StatementSync.prototype.close()
• sqlite: add StatementSync.prototypeSymbol.dispose
• src,lib: add util.markPromiseAsHandled
• util: implement util.throttle
• util: implement debounce
• Update to 24.21.0:
• crypto: update root certificates to NSS 3.126
• crypto: support loading private keys through STORE loaders
• deps: update Undici to 7.29.1
• lib,src: improve histogram implementation
• net: improve performance of net.BlockList
• perf_hooks: add statistical hypothesis testing to histogram
• util: add non-throwing MIMEType.parse
• Update to 24.20.0:
• async_hooks: add using scopes to AsyncLocalStorage
• buffer: add end parameter
• doc: add MikeMcC399 as collaborator
• lib,permission: add permission.drop
• loader: implement package maps
• src,permission: add --permission-audit
• stream: add node:stream/iter implementation
• test_runner: add context.log() and test:log event
• test_runner: report entryFile in TestStream events
• wasm: enable JSPI
• Update to 24.19.0:
• buffer: implement blob.textStream()
• deps: update OpenSSL build config to support compression
• doc: update blockList stability status to release candidate
• doc: mark stream.compose stable
• esm: add --experimental-import-text flag
• fs: support caller-supplied readFile() buffers
• http: add httpValidation option to configure header value validation
• net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive
• perf_hooks: sample delay per event loop iteration
• src: allow empty --experimental-config-file
• stream: expose ReadableStreamTee
• tls: report negotiated TLS groups
• tls: add certificateCompression option