A flaw in the NSEC validation logic of Hickory DNS allows an attacker to cause the resolver to release a secure proof for a non‑existent domain name when the covering NSEC's Next Domain Name is a strict descendant of the query. The verifier ends up believing the name does not exist, so an attacker can flip an unsigned NODATA response from NOERROR to NXDOMAIN. This can lead to forged nonexistence of domain names, potentially disrupting DNS resolution or allowing redirection to malicious targets.

The affected releases include hickory‑proto versions up to 0.26.0‑alpha.1 and hickory‑net versions up to 0.26.0‑beta.1 before 0.26.2. These are part of the Hickory DNS and Hickory DNS‑Net projects.

With a CVSS score of 6.3 the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in the KEV catalog, yet the requirement of an on‑path attacker to manipulate unsigned rcode makes it a serious concern for environments that rely on DNSSEC validation. The lack of publicly known exploits does not remove the risk for administrators who depend on accurate DNSSEC checks.