Description
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.

Repeated triggering of this condition can lead to denial of service.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Published: 2026-08-04
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Node.js’s dns.resolveAny function causes the process to abort whenever a DNS response contains more than 256 A records, resulting in a denial of service. The weakness is classified as CWE‑400 and CWE‑770, indicating uncontrolled resource consumption and memory allocation errors. Repeated triggering of the abort amplifies service disruption.

Affected Systems

Versions 26.x, 24.x, and 22.x of Node.js are affected. Any deployment of those releases that uses dns.resolveAny, directly or indirectly, is vulnerable.

Risk and Exploitability

The CVSS score of 5.9 marks this as a medium‑severity issue. EPSS is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation reports yet. An attacker can exploit the flaw by controlling DNS responses to force the node process to abort, and repeated abuse can render a service unavailable until a restart occurs.

Generated by OpenCVE AI on August 11, 2026 at 02:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Node.js to a patched release that contains the dns.resolveAny fix – consult the Node.js security advisory for the latest version.
  • If an upgrade cannot be applied immediately, isolate the vulnerable service from untrusted DNS queries or replace dns.resolveAny with a custom resolver that limits the maximum number of A records processed.
  • Enable process monitoring and automatic restart mechanisms to recover from accidental or malicious process abortions.

Generated by OpenCVE AI on August 11, 2026 at 02:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Node.js dns.resolveAny Denial of Service via Excessive A Records nodejs: Node.js: Denial of Service via DNS responses with excessive A records
Weaknesses CWE-770
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 07 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Nodejs
Nodejs nodejs
Vendors & Products Nodejs
Nodejs nodejs

Tue, 04 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Node.js dns.resolveAny Denial of Service via Excessive A Records

Tue, 04 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Description A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Weaknesses CWE-400
References
Metrics cvssV3_0

{'score': 5.9, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nodejs Nodejs
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-08-04T15:03:30.449Z

Reserved: 2026-06-27T15:00:00.780Z

Link: CVE-2026-58042

cve-icon Vulnrichment

Updated: 2026-08-04T14:19:37.262Z

cve-icon NVD

Status : Received

Published: 2026-08-04T01:16:20.123

Modified: 2026-08-04T16:16:25.940

Link: CVE-2026-58042

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-04T00:49:58Z

Links: CVE-2026-58042 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T02:15:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling