CVE-2026-105482: Node.js dns.resolve*() silently truncates hostnames at a NUL byte

High 7.4 EPSS 0.5% Node.js

dns.resolve*() and dns.reverse() pass names to c-ares as C strings, so attacker.example\0.trusted.example is resolved as attacker.example without an error. Applications that validate a hostname (for example against an allowlist) and then resolve it can act on records for a different name. This is an incomplete fix of CVE-2026-48930; fixed in the October 21, 2026 releases (High, CVSS 7.4; Red Hat Important), with no known exploitation.

CVE-2026-105482CVE identifier
7.4CVSS 3.0 base score (high)
0.5%EPSS: chance of exploitation in the next 30 days (higher than 41% of CVEs)
2026-10-23published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Node.js and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Node.js never reloads its binary or libraries: restart every long-running node process after updating. systemd: sudo systemctl restart <app>.service. PM2: pm2 update (restarts the PM2 daemon and all apps on the new runtime), then pm2 save; with nvm, reinstall pm2 under the new version first (nvm install --reinstall-packages-from does this). Containers: rebuild the image and recreate the containers / roll out the pods; restarting an old container keeps the old Node.js. Confirm with node -v in the same environment the service uses.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

Node.js 22.x up to 22.23.3
Node.js 24.x up to 24.22.0
Node.js 26.x up to 26.12.0
End-of-life lines receive no fix

Fixed in:

Node.js 22.23.4
Node.js 24.22.1
Node.js 26.12.1

Node.js lines affected: 22.x || 24.x || 26.x; fixed in ^22.23.4 || ^24.22.1 || ^26.12.1.

Am I affected?

node -v
dpkg -l nodejs 'libnode*' 2>/dev/null | grep ^ii      # Debian/Ubuntu
rpm -q nodejs nodejs22 nodejs24 2>/dev/null; dnf module list --enabled nodejs   # RHEL
apk info -v nodejs nodejs-current 2>/dev/null          # Alpine
docker run --rm <image> node -v                         # containers
pkg audit -F   # FreeBSD

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

# Debian has not released a fixed nodejs for bookworm/trixie yet (tracker, 2026-11-03).
# If Node.js comes from the NodeSource repo (deb.nodesource.com), the fixed builds are there:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

Ubuntu

# Ubuntu has not published a nodejs fix for this CVE (tracker status needs-triage, 2026-11-03).
# See https://ubuntu.com/security/CVE-2026-105482. Use a fixed upstream build instead:
# If Node.js comes from the NodeSource repo (deb.nodesource.com), the fixed builds are there:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

RHEL, AlmaLinux, Rocky, Oracle

sudo dnf module list --enabled nodejs        # RHEL 8/9: which stream is enabled
sudo dnf upgrade --refresh 'nodejs*'
node -v
# Stream with no fix (or EOL nodejs:20)? switch to a fixed stream, e.g. nodejs:24 on RHEL 8/9:
sudo dnf module reset -y nodejs && sudo dnf module enable -y nodejs:24 && sudo dnf distro-sync -y 'nodejs*'
# RHEL 10 ships nodejs22 / nodejs24 as normal packages: sudo dnf install nodejs24

Fedora

sudo dnf upgrade --refresh nodejs22 nodejs24 (nodejsNN)

SUSE / openSUSE

sudo zypper refresh
sudo zypper update nodejs22 nodejs24

Amazon Linux

sudo dnf upgrade --releasever=latest nodejs22 nodejs24 (nodejsNN)

Arch Linux

sudo pacman -Syu

Alpine

apk update
apk upgrade nodejs          # main repo (22.x on 3.22, 24.x on 3.23/3.24)
apk upgrade nodejs-current  # community repo, if installed (26.x on 3.24)
node -v

FreeBSD

pkg update
pkg upgrade node24   # or node22 / node26 / node (meta port, currently 24)
pkg audit -F

Docker images

# Move the FROM line to a fixed tag (or a moving major tag such as node:24-slim) and rebuild
#   FROM node:24.22.2-trixie-slim   (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v   # must be at least 22.23.4 / 24.22.1 / 26.12.1
docker compose up -d --force-recreate   # or redeploy / roll out the new image

Built from source

# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current   # or 22 / 26
nvm alias default 24
node -v   # must be at least 22.23.4 / 24.22.1 / 26.12.1
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2   # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -v

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

Release	Package	Status	Fixed version / advisory
Debian 12	`nodejs`	not fixed yet
Debian 13	`nodejs`	not fixed yet
Debian testing	`nodejs`	not fixed yet
Ubuntu 18.04 (ESM)	`nodejs`	being checked
Ubuntu 20.04 (ESM)	`nodejs`	being checked
Ubuntu 22.04	`nodejs`	being checked
Ubuntu 24.04	`nodejs`	being checked
Ubuntu 26.04	`nodejs`	being checked
Ubuntu 26.10	`nodejs`	being checked
Red Hat Enterprise Linux 9	`nodejs:24-9080020261027142403.rhel9`	fixed	`RHSA-2026:92378`
Red Hat Enterprise Linux 9	`nodejs:22/nodejs`	affected
Red Hat Enterprise Linux 9	`nodejs:26/nodejs`	affected
Red Hat Enterprise Linux 8	`nodejs:24-8100020261027151919.6d880403`	fixed	`RHSA-2026:92376`
Red Hat Enterprise Linux 8	`nodejs:22/nodejs`	affected
Red Hat Enterprise Linux 10	`nodejs22`	affected
Red Hat Enterprise Linux 10	`nodejs24`	affected
Red Hat Enterprise Linux 10	`nodejs26`	affected
Debian 12 (bookworm) / 13 (trixie)	`nodejs`	fixed	`no fix yet (vulnerable on 2026-11-03); fixed in sid 24.22.1+dfsg+~cs24.19.2-1`
RHEL 8 (nodejs:24 module)	`nodejs`	fixed	`1:24.22.1-1.module+el8.10.0+25218+d9e131cb (RHSA-2026:92376)`
RHEL 9 (nodejs:24 module)	`nodejs`	fixed	`1:24.22.1-3.module+el9.8.0+25216+afa2a4a4 (RHSA-2026:92378)`
RHEL 8/9 nodejs:22, RHEL 9 nodejs:26, RHEL 10 nodejs22/nodejs24/nodejs26	`nodejs`	fixed	`no fix yet (Red Hat: Affected, 2026-11-03)`
Alpine 3.22	`nodejs`	fixed	`22.23.4-r0 (secdb)`
Alpine 3.23	`nodejs`	fixed	`24.22.1-r0 (secdb)`
Alpine 3.24	`nodejs`	fixed	`24.22.1-r0 (secdb)`
Alpine 3.24	`nodejs-current`	fixed	`26.12.1-r0 (secdb)`
FreeBSD (ports/pkg)	`node22 / node24 / node26 / node`	fixed	`22.23.4 / 24.22.1 / 26.12.1 / 24.22.1 (VuXML 33a752ba-4cbe-46d8-abda-587011d90575)`

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

Red Hat: reject hostnames that contain a NUL byte before calling dns.resolve*(), and do not pass untrusted strings to dns.resolve.
Node.js 20.x reached end-of-life on 2026-04-30 and 25.x on 2026-06-01; supported lines on 2026-11-03 are 22.x and 24.x (Maintenance LTS) and 26.x (Active LTS). End-of-life lines get no further fixes.

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 17:06 UTC and reviewed by an editor. Always confirm with your vendor's advisory.