Node.js · Report #3795657
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
Validstatus
mediumseverity
12upvotes
28 Aug 2026disclosed
Summary
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.