CVE-2026-58042: 
npm vulnerability analysis and mitigation

CVE-2026-58042 is a denial-of-service vulnerability in Node.js where dns.resolveAny() aborts the Node.js process when a DNS response contains more than 256 A records. Reported by cantina-security and fixed by RafaelGSS, it was disclosed on July 29, 2026 as part of Node.js's July 2026 security release batch. Affected versions include Node.js 26.x (up to and including 26.5.0), 24.x (up to and including 24.18.0), and 22.x (up to and including 22.23.1). It carries a CVSS v3 base score of 5.9 (Medium) (Node.js Advisory, Github Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): the dns.resolveAny() function in Node.js fails to properly handle DNS responses that contain more than 256 A records, triggering a process abort rather than gracefully handling the oversized response. The attack vector is network-based with high attack complexity, as an attacker would need to be in a position to influence DNS responses seen by the target Node.js application — for example, by operating a malicious or compromised DNS server, or via DNS spoofing. No privileges or user interaction are required for exploitation (Node.js Advisory, Github Advisory).

Successful exploitation causes the Node.js process to abort entirely, resulting in complete loss of availability for any application relying on dns.resolveAny(). There is no confidentiality or integrity impact. Repeated triggering of this condition can sustain a denial-of-service condition, making affected services persistently unavailable (Node.js Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The NVD SSVC assessment classifies the vulnerability as not automatable with no known exploitation. The EPSS score is approximately 0.40–0.46%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Node.js Advisory).

1. Reconnaissance: Identify a target application running a vulnerable Node.js version (22.x ≤ 22.23.1, 24.x ≤ 24.18.0, or 26.x ≤ 26.5.0) that calls dns.resolveAny() as part of its request handling or internal logic.
2. Position for DNS manipulation: Gain the ability to influence DNS responses seen by the target — for example, by operating a rogue authoritative DNS server for a domain the application queries, or by performing DNS spoofing/poisoning on the network path.
3. Craft malicious DNS response: Prepare a DNS response for the queried domain that contains more than 256 A records in the answer section.
4. Deliver the response: When the target Node.js application calls dns.resolveAny() for the controlled domain, serve the crafted oversized DNS response.
5. Trigger process abort: The Node.js process aborts upon receiving the response with more than 256 A records, causing the application to crash and become unavailable.
6. Repeat for sustained DoS: Repeatedly trigger the DNS query (e.g., by sending requests that cause the application to re-resolve the domain) to maintain a persistent denial-of-service condition (Node.js Advisory, Github Advisory).

• Logs: Unexpected Node.js process crash logs or core dumps with no clear application-level error; absence of graceful shutdown messages in application logs coinciding with DNS resolution activity.
• Process: Sudden termination of the Node.js process (exit code indicating abort/signal) during or shortly after dns.resolveAny() calls; process monitoring tools (e.g., PM2, systemd) reporting repeated unexpected restarts.
• Network: DNS responses to the Node.js host containing an unusually high number (>256) of A records for a single query; DNS traffic from unexpected or external resolvers to the application host.

Update Node.js to the patched releases: v22.23.2, v24.18.1, or v26.5.1, which address this vulnerability. As a network-level workaround, consider implementing DNS response filtering (e.g., via a DNS proxy or firewall rule) to limit or reject responses containing more than 256 A records before they reach the Node.js process. Additionally, monitor Node.js process behavior for unexpected crashes related to DNS resolution operations (Node.js Advisory, Github Advisory).

The vulnerability was part of a broader July 2026 Node.js security release addressing 11 CVEs, which received coverage from security news outlets including CyberSecurityNews and CyberPress. HeroDevs published a blog post covering the July 2026 security release in the context of Node.js 18 and 20 reaching end-of-life. SUSE and openSUSE issued security advisories and package updates for their distributions. Amazon Linux 2023 also issued an advisory (ALAS2023-2026-2060). Overall community reaction was moderate, consistent with a medium-severity DoS issue with no public exploit (Node.js Advisory).