CVE-2026-105482

Katalog CVE

CVSS 7.4 · High

Kerentanan Improper Access Control. Skor CVSS 3.0 7.4 (High) menurut hackerone.com.

Deskripsi (NVD)

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rilis Keamanan Node.js Oktober 2026, Celah Brotli CVE-2026-111497 Berpotensi Eksekusi Kode Jarak Jauh 24 Okt 2026

Rincian

Terbit di NVD

23 Oktober 2026

Terakhir diubah

23 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.0

7.4 (High), sumber hackerone.com
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases