Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Node.js. The callback- and promise-based dns.resolve APIs did not reject hostnames containing an embedded NUL character. Because c-ares treats the name as a C string, a name such as example.com\0.trusted.corp is truncated to example.com, so the resolver returns records for an unintended hostname.