Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105482

Quick assessment

Affected
nodejs node
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node.js 的 DNS 解析功能存在一个缺陷：当主机名包含空字节（NUL byte）时， 函数和 会静默截断该主机名。这是针对 CVE-2026-48930 的不完整修复，此前该修复仅覆盖了 以及 和 模块中的主机选项。 由于主机名是以 C 字符串形式传递给 c-ares 库的，当查询类似 的主机名时，系统实际解析的是截断后的 ，并返回其记录，且不会抛出任何错误。因此，若应用程序先对主机名进行验证（例如对照域名白名单），随后再使用 进行解析，则可能基于与已验证名称不同的目标记录执行操作，从而引发安全风险。 此漏

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1071.004 · DNS

Affected Version Matrix 3

VendorProduct Version RangeStatus
nodejs node 22.23.3≤ 22.23.3 affected
24.22.0≤ 24.22.0 affected
26.12.0≤ 26.12.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105482

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nodejs node 22.23.3 ~ 22.23.3 -

II. Public POCs for CVE-2026-105482

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105482

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-105482 (1)

Same Patch Batch · nodejs · 2026-10-23 · 9 CVEs total

CVE-2026-105481 Node.js 22/24/26.x HTTP 代理连接重用漏洞
CVE-2026-105483 Node.js 24.x/26.x TLS 主机验证绕过漏洞
CVE-2026-106074 Node.js 22/24/26 crypto 快照熵缓存漏洞
CVE-2026-106069 Node.js 22/24/26 TLS 主机验证漏洞
CVE-2026-106071 Node.js 26.x 权限模型文件系统漏洞
CVE-2026-106070 Node.js 26.x 中 zlib.ZipFile API 的任意字节读取漏洞
CVE-2026-106072 Node.js 22/24/26 TLS 主机验证绕过漏洞
CVE-2026-106073 Node.js 22/24/26 权限模型文件路径绕过漏洞

IV. Related Vulnerabilities

Same product: node
Same vendor: nodejs
Same weakness: CWE-284

V. Comments for CVE-2026-105482

No comments yet

Leave a comment