Node.js DNS resolveAny() Aborts Process on >256 A Records (DoS)
CVE-2026-58042 Published on August 4, 2026
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-58042 has been classified to as a Resource Exhaustion vulnerability or weakness.
Affected Versions
nodejs node:- Version 26.5.0, <= 26.5.0 is affected.
- Version 24.18.0, <= 24.18.0 is affected.
- Version 22.23.1, <= 22.23.1 is affected.