Node.js · Report #3656716
Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
Validstatus
mediumseverity
4upvotes
25 Jun 2026disclosed
Summary
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.