· javascript
Wednesday, October 21, 2026 Security Releases
Security releases available Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.
This security release includes the following dependency updates to address public vulnerabilities: A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error.
Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to Hasan Flayyih Abdullah for reporting this vulnerability and thank you jasnell for fixing it.
