Triage playbook for suspected CVE-2026-105482 exploitation
An alert about CVE-2026-105482 may arrive as a scanner finding, a runtime-version report, or a suspicious DNS request. The first task is not to label every Node.js system compromised. The team needs to establish whether an affected runtime received an attacker-controlled hostname and acted on a truncated resolution result.
Establish the technical facts
The flaw affects Node.js dns.resolve*() and dns.reverse(). A hostname containing a NUL byte can be silently shortened at the c-ares boundary. The resolver then returns records for the shorter name without an error. The Node.js advisory calls the issue an incomplete fix of CVE-2026-48930, which covered dns.lookup() and host options in net and tls.
The issue is rated high severity. The GitHub Advisory Database lists CVSS 3.0 score 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. That describes a network-accessible condition with high attack complexity and potential confidentiality and integrity impact.
Confirm the runtime
Node.js 22.x, 24.x, and 26.x are affected before the fixed releases. The patched versions are Node.js 22.23.4, 24.22.1, and 26.12.1. Check the actual process and package version from the deployed host, container, or serverless environment. A dependency scanner that reports an application library is not evidence that the runtime is patched.
Record where the process runs, who owns it, what it exposes, and whether it can make outbound network connections. A build tool with no untrusted hostname input is lower priority than a customer-facing URL fetcher, but it may still have access to internal build networks.
Trace the vulnerable sequence
Look for request handlers and integration jobs that accept a hostname or URL. Determine whether the value reaches dns.resolve*() or dns.reverse() and whether a policy check happens before or after that call. The important question is whether the application validates the full string but resolves the truncated one.
Review logs for control-character encoding, suspicious suffixes after a NUL, and DNS records returned for a shorter name than the policy object. Compare the approved hostname with the address used by the outbound connection. Preserve the original request representation before any log normalizer removes the byte.
Containment
If a vulnerable application path is confirmed, restrict outbound access to required destinations. Block metadata, loopback, link-local, private networks, and administrative endpoints where the application has no legitimate need for them. Disable or pause the affected workflow if the business impact is acceptable.
Upgrade to a fixed Node.js release and rebuild the artifact. Rotate credentials only if the evidence shows that a protected secret was exposed or used. A hostname bypass alone does not prove credential theft. Reset sessions or tokens when suspicious responses or unexpected outbound traffic provide a reason to do so.
Exposure evidence and limits
The ZoomEye Search app="Node.js" returned 5,537,125 product matches during this review. The CVE Filter vul.cve="CVE-2026-105482" returned 0. The product count is not a vulnerable-asset count, and the zero Filter result does not override the vendor advisory. Use both as inventory context, not as incident proof.
Evidence to collect
Preserve the application version, runtime version, deployment revision, and image digest. Collect request and DNS logs that cover the suspected time range, along with proxy and network-flow records for outbound destinations. Record the exact query used in ZoomEye and the observation time if asset data is part of the investigation.
Keep a timeline that separates a scanner match, an affected runtime, a vulnerable code path, and an actual security action. Those are different levels of confidence. A system can match the runtime product and still have no exploitable workflow.
Recovery criteria
The runtime upgrade is deployed to every affected artifact. The vulnerable DNS path rejects NUL input or canonicalizes it before resolution. Outbound policy checks the resolved address. Tests cover the complete request path, and monitoring records a mismatch between the approved name and the connection target.
After those steps, retain a review item for application logic that still treats a boolean hostname check as authorization for a later network action. CVE-2026-105482 can be fixed in the runtime, but that architectural assumption can survive the patch.
Top comments (0)