CVE-2026-33630: 
Node.js vulnerability analysis and mitigation

CVE-2026-33630 is a use-after-free / double-free vulnerability in c-ares' query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. It affects c-ares versions greater than 1.32.3 up through 1.34.6, and was fixed in version 1.34.7. The vulnerability was published on July 6–7, 2026, and disclosed via the oss-security mailing list and a GitHub Security Advisory. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a use-after-free / double-free (CWE-416, CWE-415) in c-ares' internal query-completion path, where a query's callback is invoked while the query is still linked in the channel's internal lookup structures. The flaw exists at multiple points in the resend/finish path — including timeout handling, response handling, and query dispatch. The remote exploitation path requires no application cooperation: an attacker acting as a malicious or on-path DNS server first forces the client onto TCP by setting the truncation (TC) bit in a UDP response, then returns a FORMERR without an OPT record (forcing an EDNS-downgrade retry), followed by a second response with the same query ID, and finally resets the TCP connection — causing ares_getaddrinfo()'s internal completion handler to re-enter and access a host_query that has already been freed. This was reproduced deterministically under AddressSanitizer against v1.34.6. The same pattern was previously partially addressed under CVE-2025-31498; CVE-2026-33630 covers the remaining occurrences (GitHub Advisory, oss-security).

Successful exploitation results in memory corruption and a crash of the affected application, causing a denial of service. Because c-ares is widely used as a DNS resolution library in many applications and runtimes, a crash can disrupt any service relying on it for name resolution. While reliable code execution has not been demonstrated, the use-after-free condition may have further impact depending on the memory allocator and build configuration (GitHub Advisory, Red Hat Bugzilla).

1. Position as on-path or malicious DNS server: The attacker must be able to intercept or respond to DNS queries from the target application, either via network positioning (e.g., ARP spoofing, BGP hijacking) or by controlling a DNS server the client uses.
2. Force TCP upgrade: Send a crafted UDP DNS response with the truncation (TC) bit set, causing the c-ares client to retry the query over TCP.
3. Send FORMERR without OPT record: Over the established TCP connection, respond to the client's DNS query with a FORMERR response that omits the OPT record, forcing c-ares to initiate an EDNS-downgrade retry.
4. Send a second response with the same query ID: Immediately send a second DNS response using the same query ID, triggering the internal completion handler to re-enter.
5. Reset the TCP connection: Reset the TCP connection, causing the follow-on lookup's send to fail and complete immediately, which causes ares_getaddrinfo()'s completion handler to access the already-freed host_query structure.
6. Trigger crash: The resulting heap-use-after-free causes memory corruption and a crash (denial of service) in the target application (GitHub Advisory, oss-security).

• Network: Unexpected TCP DNS connections (port 53) from the application, especially following UDP responses with the TC bit set; DNS responses containing FORMERR codes without OPT records; rapid TCP connection resets from DNS servers.
• Logs: Application crash logs or core dumps referencing c-ares or DNS resolution functions; AddressSanitizer output indicating heap-use-after-free in ares_getaddrinfo() completion handler if the application is built with sanitizers.
• Process: Unexpected termination or crash of applications using c-ares for DNS resolution; repeated restarts of services that rely on c-ares (e.g., Node.js, curl-based services) without clear cause.

Upgrade to c-ares version 1.34.7 or later, which fully resolves the vulnerability by routing all deferred retries and completions through a single iterative drain and fully detaching each query from lookup structures before invoking its callback. As a partial application-level workaround, avoid calling ares_cancel() from within a query callback; however, this does not address the remotely-triggered path. For the remote path, prefer trusted DNS resolvers reached over a trusted transport (e.g., DNS-over-TLS), and implement network segmentation to restrict DNS traffic to known-good servers. Red Hat Enterprise Linux 10 users can apply RHSA-2026:42096; Fedora and Amazon Linux 2023 updates are also available (GitHub Advisory, Red Hat Errata, oss-security).

The vulnerability was reported independently by multiple researchers and disclosed by c-ares maintainer Brad House via the oss-security mailing list alongside the 1.34.7 release. The Slackware project issued SSA-2026-187-01 addressing the issue, and Fedora and Amazon Linux 2023 also released updates. The disclosure noted a relationship to CVE-2025-31498, which had previously addressed the same pattern at one call site, indicating ongoing security hardening of the c-ares query-completion path (oss-security, GitHub Advisory).