Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.
Hello Red Hat Product Security team, A public proof of concept (PoC) has been reported for CVE-2026-105482, a Node.js DNS hostname truncation issue involving embedded NUL bytes. PoC reference: https://github.com/CaterMaoZi/CVE-2026-105482-POC According to the report, dns.resolve*() may resolve a different hostname from the one validated by an application, potentially bypassing domain allowlist checks. This issue has been described as an incomplete fix for CVE-2026-48930. I have not independently reproduced the PoC on RHEL. I am sharing the reference for your awareness and impact assessment. Thank you.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:92376 https://access.redhat.com/errata/RHSA-2026:92376
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:92378 https://access.redhat.com/errata/RHSA-2026:92378