Node.js EUVD-2026-52553

Upgrade Node.js to v26.5.1 or later; this is the vendor-released patch confirmed by the GitHub release at https://github.com/nodejs/node/releases/tag/v26.5.1 and the Node.js security blog at https://nodejs.org/en/blog/vulnerability/july-2026-security-releases. If immediate upgrade is not possible, the primary compensating control is to restrict or eliminate application-level use of dns.resolveAny() - removing calls to this API eliminates the vulnerable code path entirely, though this may break functionality that depends on ANY-record lookups. A secondary control is to enforce DNS traffic routing through a trusted, response-validating resolver (e.g., a local recursive resolver with DNSSEC validation and response-size limits such as those available in Unbound or BIND with max-udp-size and edns-udp-size tuning), which reduces the attacker's ability to deliver oversized replies. Neither workaround is a substitute for patching. Note that the v26.5.1 release also fixes nine additional CVEs including two High-severity issues, making upgrade strongly advisable on that basis alone.