Node.js (< 22.23.4, < 24.22.1, < 26.12.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/node.js--22.23.4--24.22.1--26.12.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 17:05:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNode.js: DNS Resolver NUL Byte Truncation (CVE-2026-105482)https://feed.craftedsignal.io/briefs/2026-10-nodejs-dns-ssrf/Wed, 21 Oct 2026 17:05:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-nodejs-dns-ssrf/Node.js is vulnerable to NUL byte truncation in dns.resolve* functions, allowing attackers to bypass allowlist filters and perform SSRF by injecting a NUL character into hostname strings.Node.js versions before 22.23.4, 24.22.1, and 26.12.1 are vulnerable to a NUL byte truncation issue within the dns.resolve* functions. The vulnerability exists because these functions pass hostname strings to the c-ares library, which processes them as C-style strings. When a NUL byte (\0) is included in a hostname (e.g., attacker.com\0.trusted.corp), application-level allowlist checks may evaluate the full string as legitimate, but the underlying DNS resolver truncates the string at the NUL byte, resulting in a query to an attacker-controlled domain. This flaw enables Server-Side Request Forgery (SSRF) against internal services.

Impact

Successful exploitation allows an attacker to bypass domain-based allowlists implemented via endsWith, includes, or match functions. This facilitates SSRF attacks against internal infrastructure, including 169.254.169.254 (metadata services), local services, or restricted internal network assets.

Recommendation

  • Upgrade Node.js installations to the patched versions: 22.23.4, 24.22.1, or 26.12.1.
  • Implement application-level input validation to reject hostnames containing a NUL byte (\0) before passing them to DNS resolution functions.
  • Audit custom security wrappers that rely on hostname string comparisons to filter outgoing traffic or allowlist internal resources.
]]>highadvisoryssrfnodejsdnsvulnerability