Node.js: DNS Resolver NUL Byte Truncation (CVE-2026-105482)

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 are vulnerable to a NUL byte truncation issue within the dns.resolve* functions. The vulnerability exists because these functions pass hostname strings to the c-ares library, which processes them as C-style strings. When a NUL byte (\0) is included in a hostname (e.g., attacker.com\0.trusted.corp), application-level allowlist checks may evaluate the full string as legitimate, but the underlying DNS resolver truncates the string at the NUL byte, resulting in a query to an attacker-controlled domain. This flaw enables Server-Side Request Forgery (SSRF) against internal services.

Impact

Successful exploitation allows an attacker to bypass domain-based allowlists implemented via endsWith, includes, or match functions. This facilitates SSRF attacks against internal infrastructure, including 169.254.169.254 (metadata services), local services, or restricted internal network assets.

Recommendation

• Upgrade Node.js installations to the patched versions: 22.23.4, 24.22.1, or 26.12.1.
• Implement application-level input validation to reject hostnames containing a NUL byte (\0) before passing them to DNS resolution functions.
• Audit custom security wrappers that rely on hostname string comparisons to filter outgoing traffic or allowlist internal resources.