{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105482","assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","state":"PUBLISHED","assignerShortName":"hackerone","dateReserved":"2026-10-05T15:00:00.729Z","datePublished":"2026-10-23T16:15:05.831Z","dateUpdated":"2026-10-23T16:15:05.831Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"affected":[{"defaultStatus":"unaffected","vendor":"nodejs","product":"node","versions":[{"version":"22.23.3","status":"affected","lessThanOrEqual":"22.23.3","versionType":"semver"},{"version":"24.22.0","status":"affected","lessThanOrEqual":"24.22.0","versionType":"semver"},{"version":"26.12.0","status":"affected","lessThanOrEqual":"26.12.0","versionType":"semver"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}],"metrics":[{"cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","cweId":"CWE-284","description":"CWE-284 Improper Access Control - Generic"}]}],"providerMetadata":{"orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone","dateUpdated":"2026-10-23T16:15:05.831Z"}}}}