Описание
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.
Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.
Отчет
This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.
Меры по смягчению последствий
To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs22 | Affected | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Affected | ||
| Red Hat Enterprise Linux 10 | nodejs26 | Affected | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Affected | ||
| Red Hat Hardened Images | hi/nodejs | Not affected | ||
| Red Hat Hardened Images | nodejs20 | Will not fix | ||
| Red Hat Hardened Images | nodejs24 | Will not fix | ||
| Red Hat Hardened Images | nodejs25 | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byt ...
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
EPSS
7.4 High
CVSS3