CVE-2026-58042
5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nodejs | node | 26.5.0 <= 26.5.0 | affected |
| nodejs | node | 24.18.0 <= 24.18.0 | affected |
| nodejs | node | 22.23.1 <= 22.23.1 | affected |
Weaknesses
- CWE-400: CWE-400 Uncontrolled Resource Consumption
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.