← All advisories

Medium severity5.9NVD Advisory· Published Aug 4, 2026· Updated Sep 3, 2026

CVE-2026-58042

CVE-2026-58042

Description

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.

Repeated triggering of this condition can lead to denial of service.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7

osv-coords6 versions
pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/nodejs26&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/nodejs22&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed pkg:bitnami/node pkg:bitnami/node-min
< 24.18.1-160000.1.1+ 5 more
- (no CPE)range: < 24.18.1-160000.1.1
- (no CPE)range: < 26.5.1-1.1
- (no CPE)range: < 22.23.2-160000.1.1
- (no CPE)range: < 24.18.1-1.1
- (no CPE)range: < 22.23.2
- (no CPE)range: < 22.23.2
Node.js/Node.jsllm-fuzzy
Range: 26.x, 24.x, 22.x

Patches

Vulnerability mechanics

References

1

nodejs.org/en/blog/vulnerability/july-2026-security-releasesnvd

News mentions

1

Node.js Fixes 11 Security Flaws That Can Crash Servers and Break Filesystem Restrictions
Cyber Security News · Jul 30, 2026