CVE-2026-58042 Overview
CVE-2026-58042 is a denial-of-service vulnerability in Node.js affecting the dns.resolveAny() function. The runtime aborts the entire Node.js process when a DNS response contains more than 256 A records. Repeated triggering of this condition allows a remote attacker to cause sustained denial of service against affected applications. The flaw is classified under CWE-400: Uncontrolled Resource Consumption and impacts Node.js 26.x, 24.x, and 22.x release lines.
Critical Impact
A crafted DNS response with more than 256 A records causes dns.resolveAny() to abort the Node.js process, enabling repeatable remote denial of service.
Affected Products
- Node.js 26.x
- Node.js 24.x
- Node.js 22.x
Discovery Timeline
- 2026-08-04 - CVE-2026-58042 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-58042
Vulnerability Analysis
The issue resides in the dns.resolveAny() API within Node.js core. When the resolver receives a DNS response carrying more than 256 A records, an internal boundary condition triggers a fatal abort rather than returning an error to the caller. Because the abort terminates the process, any application that invokes dns.resolveAny() on attacker-influenced hostnames can be forced offline. Refer to the Node.js July 2026 Security Release for maintainer details.
Root Cause
The defect is an unchecked resource-handling condition in the DNS resolution path. The resolveAny() code path does not gracefully handle responses exceeding the internal 256-record limit for A records. Instead of surfacing a recoverable error to JavaScript, the runtime aborts, mapping to [CWE-400: Uncontrolled Resource Consumption].
Attack Vector
Exploitation requires a network-adjacent condition in which an attacker controls or influences DNS responses returned to the Node.js resolver. This can occur when applications resolve attacker-supplied hostnames, when an attacker operates an authoritative name server for a queried domain, or in environments where DNS responses can be manipulated in transit. Each successful trigger crashes the Node.js process, and repeated triggering sustains the denial-of-service condition.
No verified public exploit code is available. See the Node.js July 2026 Security Release for technical details.
Detection Methods for CVE-2026-58042
Indicators of Compromise
- Unexpected Node.js process aborts or crash logs referencing DNS resolution paths.
- DNS responses observed on the network containing more than 256 A records for a single query.
- Repeated application restarts correlated with outbound DNS lookups to attacker-influenced domains.
Detection Strategies
- Monitor Node.js process supervisors (systemd, PM2, Kubernetes) for abnormal crash-loop patterns tied to DNS activity.
- Inspect application logs for calls to dns.resolveAny() immediately preceding process termination.
- Analyze passive DNS telemetry for oversized A record response sets targeting internal resolvers.
Monitoring Recommendations
- Alert on Node.js exit codes indicating abort signals in production workloads.
- Correlate DNS query volume and response sizes with application availability metrics.
- Track resolution of externally supplied hostnames from user input, webhooks, or SSRF-adjacent code paths.
How to Mitigate CVE-2026-58042
Immediate Actions Required
- Upgrade Node.js to a patched release in the 26.x, 24.x, or 22.x line as published in the Node.js July 2026 Security Release.
- Audit application code for use of dns.resolveAny() against untrusted or user-supplied hostnames.
- Restrict outbound DNS resolution to trusted, filtered resolvers where possible.
Patch Information
The Node.js project addressed CVE-2026-58042 in the July 2026 security release covering the 26.x, 24.x, and 22.x branches. Consult the Node.js July 2026 Security Release advisory for exact fixed versions and upgrade instructions.
Workarounds
- Replace dns.resolveAny() calls with more specific queries such as dns.resolve4() or dns.resolve6() where feasible.
- Filter or cap DNS responses at an intermediate resolver to reject responses containing more than 256 A records.
- Isolate Node.js services behind process supervisors that rate-limit restarts to reduce impact of repeated aborts.
# Verify current Node.js version and upgrade to the patched release
node --version
# Upgrade using your package manager or nvm, then confirm
nvm install --lts
node --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
