Resource exhaustion in Node.js Node

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.

Repeated triggering of this condition can lead to denial of service.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Published 2026-08-04 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS 0.004, 31.1th percentile (scored 2026-11-11); unchanged over 30 days. About EPSS.

5 public repositories with exploit or proof-of-concept code for this CVE:

CompleTech-Security/node-cve-2026-58042-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58042: DNS resolveAny process abort. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
CompleteTech-Security/node-cve-2026-58042-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58042: DNS resolveAny process abort. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
CompleTetech-Security/node-cve-2026-58042-check (last pushed 2026-10-26): Offline Node.js evidence checker for CVE-2026-58042: DNS resolveAny process abort. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
completetech-security/node-cve-2026-58042-check (last pushed 2026-10-24): Standalone defensive checker project for CVE-2026-58042: Node.js: DNS resolveAny process abort. One exploit per repository; implementation pending.
CompleteTech-LLC/node-cve-2026-58042-check (last pushed 2026-10-24): Standalone defensive checker project for CVE-2026-58042: Node.js: DNS resolveAny process abort. One exploit per repository; implementation pending.