The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Oct 28, 2026 | Oct 23, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-debugsourceUpgrade nodejs22Upgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs22-docsUpgrade nodejs22-libsUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs22-npmUpgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs22-develUpgrade nodejs24-docsUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfo | Oct 28, 2026 | Oct 23, 2026 |
| Nodejs | — | Upgrade Node.js to version 22.23.4Upgrade Node.js to version 26.12.1Upgrade Node.js to version 24.22.1Upgrade to the latest version of Node.js | Oct 26, 2026 | Oct 23, 2026 |
| Redhat_linux | — | No solution exists | Oct 26, 2026 | Oct 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub