A Node.js DNS resolution flaw permits hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). The C string passed to c-ares resolves only the portion before the NUL, returning records for the truncated name without signalling an error. Because applications often validate a hostname against a whitelist before calling dns.resolve(), the truncation allows an attacker to bypass that validation, causing the application to operate on DNS records for a completely different domain. This deficiency is categorized as CWE-284 (improper authorization) and CWE-158 (improper restriction of operations within bounds of a memory buffer), allowing unauthorized access or data leakage.

The vulnerability affects the Node.js runtime provided by nodejs:node for the 26.x, 24.x, and 22.x series of releases. The issue is present in the dns module starting in the affected Node.js versions and persists until the published security release that contains the correct handling of NUL characters.

The CVSS score of 7.4 indicates a high‑severity weakness that can be exploited if the application receives untrusted hostnames. While the EPSS score is not available, the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation requires an application that validates hostnames but subsequently resolves them with dns.resolve* or dns.reverse; the attacker can craft a hostname containing a NUL byte, causing the function to resolve a different domain. The impact depends on the application’s use of the resolved records, potentially enabling data exposure or denial of service in vulnerable code paths.