Improper Neutralization of Null Byte or NUL Character in Node.js - CVE-2026-105482
Published: October 26, 2026
Vulnerability identifier: #VU157668
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105482
CWE-ID: CWE-158
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass hostname-based validation and cause an application to use DNS records for a different domain.
The vulnerability exists due to improper handling of embedded null bytes in Node.js dns.resolve*() and dns.reverse() when passing hostnames to c-ares as C strings. A remote attacker can supply a hostname such as attacker.example .trusted.example to an application that validates the full hostname before resolution, causing the resolver to query attacker.example instead and potentially bypass domain allowlist restrictions.
Affected software
Node.js
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
Anolis OS
nodejs-npm
v8-13.6-devel
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-docs
How to mitigate CVE-2026-105482
Install security update from vendor's website.
Node.js - addressed in versions 22.23.4, 24.22.1, 26.12.1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1
nodejs-npm - update to 11.19.1-1.24.22.1.1
v8-13.6-devel - update to 13.6.233.17-1.24.22.1.1
nodejs - update to 24.22.1-1
nodejs-devel - update to 24.22.1-1
nodejs-full-i18n - update to 24.22.1-1
nodejs-libs - update to 24.22.1-1
nodejs-docs - update to 24.22.1-1