Bug 2510854 (CVE-2026-58042)

Summary:	CVE-2026-58042 nodejs: Node.js: Denial of Service via DNS responses with excessive A records
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gtanzill, jbuscemi, kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of 'A' records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2513848, 2513849
Bug Blocks:

Description OSIDB Bzimport 2026-08-04 01:01:30 UTC

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.

Repeated triggering of this condition can lead to denial of service.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.