CVE-2026-105482

CVE-2026-105482 is a vulnerability in Node.js that affects the `dns.resolve` function across the 22.x, 24.x, and 26.x release lines. The flaw causes the function to truncate domain names when they contain a NUL (null) character. This behavior can lead to inconsistent name handling, which poses a risk for applications that rely on precise validation of hostnames before executing DNS lookups. The issue was reported by security researcher hasanfleyah and resolved by James M Snell. To address the vulnerability, the Node.js project released updates on October 21, 2026, introducing input validation for null bytes in DNS resolve functions. Users are advised to upgrade to the patched versions, which include Node.js 22.23.4, 24.22.1, and 26.12.1.