CVE-2026-58042

Summary

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.

Repeated triggering of this condition can lead to denial of service.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

VendorProductVersion RangeStatus
nodejsnode26.5.0 <= 26.5.0affected
nodejsnode24.18.0 <= 24.18.0affected
nodejsnode22.23.1 <= 22.23.1affected

Weaknesses

  • CWE-400: CWE-400 Uncontrolled Resource Consumption

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References