CVE-2026-33630: 
Node.js vulnerability analysis and mitigation

CVE-2026-33630 is a use-after-free / double-free vulnerability in c-ares' query-completion handling, affecting versions 1.32.3 through 1.34.6 (i.e., >= 1.32.3, < 1.34.7). The flaw allows a query's callback to be invoked while the query is still linked in the channel's internal lookup structures, causing the query (or its owning host_query for ares_getaddrinfo()) to be accessed and/or freed a second time. It was published on July 6–7, 2026, and fixed in c-ares 1.34.7. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-416 (Use After Free) and CWE-415 (Double Free). The flaw exists at multiple points in the resend/finish path — timeout handling (process_timeouts()), response handling (read_answers()), and query dispatch (ares_send_query()) — where a query's callback is invoked before the query is detached from the channel's internal lookup structures (queries_by_qid / all_queries). There are two exploitation paths: (1) application-triggered, where a callback re-enters c-ares (e.g., calling ares_cancel()), freeing the query which is then freed again by the caller; and (2) remotely triggered with no application cooperation, via ares_getaddrinfo() over TCP, where a malicious or on-path DNS server sends a FORMERR without an OPT record (forcing an EDNS-downgrade retry), then a second response with the same query ID, then resets the connection — causing the host_query to be freed and accessed again. An attacker can force a client onto TCP by setting the truncation (TC) bit in a UDP response. The vulnerability was reproduced deterministically under AddressSanitizer against v1.34.6 (GitHub Advisory, Fix Commit).

The primary impact is memory corruption leading to a crash (denial of service) in any application using the affected c-ares library for DNS resolution. The vulnerability is remotely triggerable with no privileges or user interaction required, making it automatable. While reliable code execution has not been demonstrated, a use-after-free condition may have further impact depending on the allocator and build configuration. Confidentiality and integrity are not directly affected; the availability impact is rated High (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.0045 (0.45%), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies it as automatable with no known exploitation (Feedly). Microsoft also addressed this CVE in their September 2026 Patch Tuesday (Microsoft MSRC).

1. Force TCP transport: Send a crafted UDP DNS response to the target application with the truncation (TC) bit set, causing c-ares to retry the query over TCP.
2. Trigger EDNS downgrade: As a malicious or on-path DNS server, respond to the TCP query with a FORMERR response that omits the OPT record, forcing c-ares to issue an EDNS-downgrade retry.
3. Send a second response with the same query ID: Immediately send a second DNS response using the same query ID over the TCP connection, causing ares_getaddrinfo()'s internal completion handler to re-enter and issue a follow-on lookup.
4. Reset the TCP connection: Reset the TCP connection so the follow-on lookup's send fails immediately and completes synchronously, triggering the double-free of the already-freed host_query structure.
5. Achieve denial of service: The memory corruption from the use-after-free/double-free causes the target application to crash (GitHub Advisory).

• Network: Unexpected TCP DNS connections from the target host (c-ares normally prefers UDP); DNS responses with the TC (truncation) bit set from untrusted resolvers; TCP connection resets from DNS servers shortly after query initiation; DNS responses containing FORMERR without OPT records followed by a second response with the same query ID.
• Process: Application crashes or unexpected termination of processes using c-ares for DNS resolution; AddressSanitizer reports of heap-use-after-free in ares_getaddrinfo() completion handler or process_timeouts().
• Logs: Application crash logs or core dumps referencing c-ares library functions (ares_getaddrinfo, ares_cancel, process_timeouts, read_answers); repeated DNS resolution failures or timeouts in application logs coinciding with TCP DNS traffic.

Upgrade c-ares to version 1.34.7 or later, which fixes the vulnerability by routing all deferred retries and completions through a single iterative drain (ares_flush_requeue()), fully detaching each query from lookup structures before invoking its callback (c-ares Release). As a partial application-level workaround, avoid calling ares_cancel() from within a query callback; however, this does not address the remotely triggered path (GitHub Advisory). For the remote attack vector, restrict DNS traffic to trusted resolvers over trusted transports (e.g., using network segmentation or DNS-over-TLS), and monitor for unexpected TCP DNS connections. Downstream distributions including Red Hat, Fedora, SUSE, openSUSE, Slackware, Alpine, Amazon Linux 2023, and Oracle Linux have issued updated packages (Red Hat Advisory).

The vulnerability was reported independently by multiple researchers, with credit given to 'Oblivionsage' in the GitHub Security Advisory (GitHub Advisory). Microsoft included CVE-2026-33630 in their September 2026 Patch Tuesday, which covered 966 flaws and 2 zero-days, drawing broad coverage from security media including BleepingComputer (BleepingComputer). Multiple Linux distributions (Red Hat, SUSE, Fedora, Slackware, Alpine, openSUSE) issued security advisories and updated packages promptly after the fix was released.