CVE-2026-58042

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x

Description A flaw exists where the dns.resolveAny() function causes the Node.js process to abort when a DNS response contains more than 256 A records. Repeatedly triggering this condition can result in a denial of service, which is a state where a system becomes unavailable to its intended users.

Recommendations Update Node.js version 22.x to the latest patched release. Update Node.js version 24.x to the latest patched release. Update Node.js version 26.x to the latest patched release. As a temporary mitigation, avoid using the dns.resolveAny() function when processing untrusted DNS responses.