Most recent entries from all

fkie_cve-2026-105482

2026-10-25T23:51:03.798886+00:00

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

GHSA-4qmx-59c6-fr6r

2026-10-25T23:51:03.798961+00:00

Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

msrc_CVE-2026-105482 — A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…

2026-10-25T23:51:03.798990+00:00

msrc_CVE-2026-105482

openSUSE-SU-2026:12248-1 — corepack24-24.22.1-1.1 on GA media

2026-10-25T23:51:03.799016+00:00

corepack24-24.22.1-1.1 on GA media

UBUNTU-CVE-2026-105482

2026-10-25T23:51:03.799034+00:00

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs, Ubuntu:Pro:20.04:LTS: nodejs, Ubuntu:Pro:22.04:LTS: nodejs, Ubuntu:24.04:LTS: nodejs, Ubuntu:26.10: nodejs, Ubuntu:26.04:LTS: nodejs

[Unknown description]