CVE-2026-58042: A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to d
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-58042
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-58042 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Node.js: Multiple vulnerabilitiescert-bund
- unknownNode.js Multiple Vulnerabilitieshkcert
- unknownMultiple Vulnerabilities in Node.js (July 30, 2026)cert-fr-avis
Recent advisories for Node.js can cause
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-58045: A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion …nvd · 2026-08-04
- lowCVE-2026-58044: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwardi…nvd · 2026-08-04
- highCVE-2026-56846: A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemo…nvd · 2026-08-04
- mediumCVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allo…nvd · 2026-07-30
- highCVE-2026-59874: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accep…nvd · 2026-07-08
- mediumCVE-2026-59871: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces …nvd · 2026-07-08
More from NVD Recent CVEs
- mediumCVE-2026-8508: An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S…2026-08-04
- highCVE-2026-6837: A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel …2026-08-04
- mediumCVE-2026-18720: A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown co…2026-08-04
- mediumCVE-2026-17614: A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileReposito…2026-08-04
- mediumCVE-2026-18719: A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the fil…2026-08-04