Technical Information

An unauthenticated attacker can exploit a hostname validation bypass vulnerability in Node.js DNS resolution functions (`dns.resolve*()` and `dns.reverse()`) by supplying a hostname containing a NUL byte, causing the hostname to be silently truncated and potentially bypass domain allowlist validation, resolving an unintended hostname.

Patch release date: Oct 21, 2026
Further information on this vulnerability is available at : CVE-2026-105482