CVE-2026-105482: Node.js dns.resolve truncates names containing NUL char

JavaScript strings can contain a NUL character; C strings end at one. The dns resolve functions hand the name to the c-ares library, and before this fix Node.js did not reject a NUL in the input, so the query used only the part before it.

That breaks any check done on the full string. A typical pattern is an allowlist or SSRF guard that accepts a name only if it ends with a trusted suffix and then resolves it. A value shaped like attacker-host, then a NUL, then .trusted.example passes a suffix check written in JavaScript, but the resolver looks up only attacker-host. The app then believes it resolved a trusted name.

The attacker needs a way to put a host name into your code: a webhook URL, an import-from-URL feature, a link preview, an agent tool that fetches a page, or a DNS-based verification step. What they gain depends on the app: routing requests to their own server, getting past a domain allowlist, or making the app trust records it should not. The fix, in lib/internal/dns, validates resolve inputs for null bytes and throws instead of resolving.

Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. End-of-life lines are not patched. The bug concerns the dns resolve family (resolve, resolve4, resolve6, resolveAny, resolveTxt and their promise forms); the advisory names dns.resolve.

node -v
npx --yes envinfo --binaries 2>/dev/null | grep -i node
docker run --rm <your-image> node -v

To find exposed code, search for dns.resolve and dns.promises.resolve calls that take a host name from user input, URLs or configuration a user can edit.

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 and restart the services. After the upgrade, a name with a NUL byte causes an error instead of a silent truncation, so make sure your code handles that rejection.

If you cannot upgrade yet, reject any host name that contains \0 (or any control character) before you validate or resolve it, and do allowlist checks on the parsed, normalized host from new URL() rather than on raw strings.

Search request logs and application logs for host names or URLs that contain %00, \u0000 or a literal NUL, especially in webhook, callback or fetch-by-URL fields. Compare the host your app logged as validated with the IP addresses it actually connected to: a trusted-looking name that resolved to an unfamiliar address is a sign of this trick. Outbound connections from the service to hosts outside its normal set are worth reviewing.

The dns.resolve family of functions in Node.js passed host names containing a NUL (\0) byte to the resolver, which truncated the name at that byte, so the name that was resolved differed from the string the application validated. The fix rejects resolve inputs that contain null bytes. Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, 2026.