PatchTheCEVCVE-2026-105482: A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re
CVE-2026-105482 is a high-severity flaw (CVSS 7.4) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.4 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-10-23 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: CaterMaoZi/CVE-2026-105482-POC (8 stars)
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.