IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.9Orta

CVE-2026-58042

nodejs node Yayım: (3 ay önce)

Açıklama

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Zayıflık türü (CWE): CWE-400

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
nodejs node 26.5.0 – ≤ 26.5.0, 24.18.0 – ≤ 24.18.0, 22.23.1 – ≤ 22.23.1

Kaynaklar ve yamalar

Aynı üründe son açıklar — Node.js

6.5Orta
CVE-2026-105481
nodejs node

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected …

7.4Yüksek
CVE-2026-105482
nodejs node

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. B…

7.4Yüksek
CVE-2026-105483
nodejs node

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIde…

7.4Yüksek
CVE-2026-106069
nodejs node

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.chec…

3.6Düşük
CVE-2026-106071
nodejs node

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops…

3.3Düşük
CVE-2026-106073
nodejs node

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--p…