CVE-2026-105482
NUL byte in DNS queries lets validated hostnames resolve to different domains
A NUL byte is a zero character that C-based functions treat as the end of a string. In Node.js, dns.resolve*() and dns.reverse() silently truncate a hostname at a NUL byte, so a name like attacker.example\0.trusted.example resolves to attacker.example. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Affected versions are Node.js 26.x, 24.x, and 22.x. No fixed version is given, and the CVE is not on CISA's known-exploited list.
nodejs node · Updated 28 Oct · From the public records
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fixed version or workaround is provided in the supplied records.
- Follow the Cisco and Fortinet advisories for updates on patched Node.js releases.
- Review any code that validates a hostname and then resolves it with dns.resolve*() or dns.reverse(), since that validation can be bypassed with a NUL byte.
What happened
- 26 OctFortinet publishes a security advisory titled Multiple Node.js CVEs affecting Fortinet products.
- 27 OctCisco publishes an advisory titled Vulnerabilities in node.js Affecting Cisco Products: October 2026.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-105482 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an i… | high 7.4 | No | 0.4% |
Our reporting
We have not reported on it. It is here because the sources below did.