Node.js CVE-2026-105482

Exploitation requires that the target application pass attacker-influenced input (a hostname or address string) into Node.js DNS resolution APIs such as dns.resolve/dns.lookup without its own null-byte sanitization; the fix is specifically to 'validate resolve inputs for null bytes'. Affected versions are Node 24.x up to and including 24.22.0, Node 22.x up to and including 22.23.3, and Node 26.x up to and including 26.12.0, fixed in the 26.12.1 security release. Limiting factors: the vulnerability is only reachable in applications that actually route untrusted input to DNS resolution; CVSS marks high attack complexity (AC:H), indicating the trigger condition is non-trivial; no user interaction and no authentication are required per the vector (UI:N, PR:N), but the exact trigger mechanism is not described in the available sources.

Signals are moderately consistent and point to a genuine but conditional priority rather than an emergency. The supplied CVSS 3.0 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) and high confidentiality and integrity impact (C:H/I:H, A:N). No EPSS score and no CISA KEV listing are present in the input, so there is no quantitative exploitation-probability or confirmed-active-exploitation signal to weigh. A public PoC reference (a GitHub gist) is listed but is explicitly not verified as working exploit code, so it should not be treated as a weaponized exploit. The vuln.today Decision label is 'this_week', which marks it as a real priority to remediate promptly rather than a drop-everything emergency. Net: this is a credible High-severity flaw in an extremely widely deployed runtime, but real-world exploitability hinges on whether a given application actually passes attacker-controlled input into Node.js DNS resolution APIs; the AC:H metric and the absence of EPSS/KEV data suggest exploitation is non-trivial and not confirmed to be widespread. One caveat to verify: the CWE is CWE-284 (Improper Access Control) and the input tags include 'Authentication Bypass' and 'Canonical', yet the fix description is narrowly 'dns: validate resolve inputs for null bytes' - the precise security consequence (e.g., access-control bypass vs. DNS query manipulation) is not spelled out in the available sources and should be confirmed against the Node.js advisory.

An application accepts a hostname from an untrusted source and passes it to a Node.js DNS resolution API (e.g., dns.resolve). An attacker supplies a hostname containing an embedded null byte that pre-patch Node.js fails to reject, manipulating how the input is interpreted during resolution. A public PoC reference (GitHub gist) exists but is not verified as working exploit code, and the high attack complexity (AC:H) indicates the condition is not trivially triggered.