{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/node.js--22.23.4--24.22.1--26.12.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-105482"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Node.js (\u003c 22.23.4, \u003c 24.22.1, \u003c 26.12.1)"],"_cs_severities":["high"],"_cs_tags":["ssrf","nodejs","dns","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Node.js"],"content_html":"\u003cp\u003eNode.js versions before 22.23.4, 24.22.1, and 26.12.1 are vulnerable to a NUL byte truncation issue within the \u003ccode\u003edns.resolve*\u003c/code\u003e functions. The vulnerability exists because these functions pass hostname strings to the c-ares library, which processes them as C-style strings. When a NUL byte (\u003ccode\u003e\\0\u003c/code\u003e) is included in a hostname (e.g., \u003ccode\u003eattacker.com\\0.trusted.corp\u003c/code\u003e), application-level allowlist checks may evaluate the full string as legitimate, but the underlying DNS resolver truncates the string at the NUL byte, resulting in a query to an attacker-controlled domain. This flaw enables Server-Side Request Forgery (SSRF) against internal services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to bypass domain-based allowlists implemented via \u003ccode\u003eendsWith\u003c/code\u003e, \u003ccode\u003eincludes\u003c/code\u003e, or \u003ccode\u003ematch\u003c/code\u003e functions. This facilitates SSRF attacks against internal infrastructure, including \u003ccode\u003e169.254.169.254\u003c/code\u003e (metadata services), local services, or restricted internal network assets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Node.js installations to the patched versions: 22.23.4, 24.22.1, or 26.12.1.\u003c/li\u003e\n\u003cli\u003eImplement application-level input validation to reject hostnames containing a NUL byte (\u003ccode\u003e\\0\u003c/code\u003e) before passing them to DNS resolution functions.\u003c/li\u003e\n\u003cli\u003eAudit custom security wrappers that rely on hostname string comparisons to filter outgoing traffic or allowlist internal resources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T17:05:59Z","date_published":"2026-10-21T17:05:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nodejs-dns-ssrf/","summary":"Node.js is vulnerable to NUL byte truncation in dns.resolve* functions, allowing attackers to bypass allowlist filters and perform SSRF by injecting a NUL character into hostname strings.","title":"Node.js: DNS Resolver NUL Byte Truncation (CVE-2026-105482)","url":"https://feed.craftedsignal.io/briefs/2026-10-nodejs-dns-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Node.js (\u003c 22.23.4, \u003c 24.22.1, \u003c 26.12.1)","version":"https://jsonfeed.org/version/1.1"}