{
  "cve": [
    "CVE-2026-105482"
  ],
  "vulnerable": "22.x || 24.x || 26.x",
  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
  "description": "dns.resolve truncates names containing NUL char",
  "overview": "A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the `dns.resolve*()` functions and `dns.reverse()`. This is an incomplete fix of CVE-2026-48930, which only covered `dns.lookup()` and the `net`/`tls` host options.\n\nBecause the name is passed to c-ares as a C string, resolving `attacker.example\\0.trusted.example` queries `attacker.example` and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with `dns.resolve*()` can act on records for a different name than the one they validated.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "high"
}