CVE-2026-69184: 
Node.js vulnerability analysis and mitigation

CVE-2026-69184 is a CPU-exhaustion denial-of-service vulnerability in the c-ares DNS resolver library, specifically in its DNS name decompression function ares_dns_name_parse(). It affects c-ares versions up to and including 1.34.6, and is patched in version 1.34.7. The vulnerability was reported by Haruto Kimura of Stella and disclosed on July 6, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, oss-security).

The root cause is an inefficient algorithmic complexity flaw (CWE-407) in ares_dns_name_parse(). While the function correctly enforced that each DNS compression pointer must jump strictly backward (preventing infinite loops), it imposed no cap on the total number of pointer hops or on the assembled name length. An attacker can craft a ~64 KB TCP DNS response containing a long descending chain of compression pointers (~8,176 deep) followed by thousands of resource records whose NAME/RDATA fields each reference the end of that chain. Each such name triggers a full re-walk of the chain, resulting in work quadratic in the message size — approximately 57 million pointer-follow operations for a single crafted response. The reporter measured a 65,524-byte malicious response taking ~2.85 seconds to parse versus ~5.7 ms for a benign same-size response (~497x slowdown) (GitHub Advisory, oss-security).

Exploitation causes availability-only impact — there is no memory corruption or data disclosure. Because c-ares operates on a single-threaded event loop, a single crafted DNS response is sufficient to stall all DNS resolution for the duration of parsing (~2.85 seconds per response). An attacker delivering crafted responses faster than they can be parsed can deny DNS resolution entirely for any application using c-ares, potentially cascading into broader service disruption for dependent applications (GitHub Advisory).

The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity. Exploitation requires a malicious or on-path DNS server that can respond to a victim's DNS query with a crafted TCP response. A proof-of-concept reproducer was provided in the private report to the c-ares maintainers. The CVE status is listed as "Reserved" and no public PoC code, exploit kit integration, or confirmed in-the-wild exploitation has been reported as of the disclosure date. CISA KEV catalog status and EPSS score are not yet available (GitHub Advisory, oss-security).

1. Position as malicious/on-path DNS server: The attacker must be able to respond to a victim's DNS query — either by operating a malicious resolver the victim is configured to use, or by performing an on-path (MitM) interception of DNS traffic.
2. Force TCP transport: Optionally set the truncation (TC) bit in a UDP response to force the client to retry the query over TCP, enabling delivery of the large crafted response.
3. Craft the malicious DNS response: Construct a ~64 KB TCP DNS response containing a descending chain of ~8,176 compression pointers (each pointing to the previous one) in a RAW_RR RDATA section, followed by ~3,510 NS records whose NAME and NSDNAME fields each reference the end of the pointer chain.
4. Deliver the response: Send the crafted response to the victim's c-ares-based application in reply to a legitimate DNS query.
5. Achieve DoS: The c-ares event loop stalls for ~2.85 seconds processing the single response (~57M pointer-follow operations). Repeating this at a rate faster than the parse time denies DNS resolution entirely for the application (GitHub Advisory, oss-security).

• Network: Large (~64 KB) TCP DNS responses from a resolver, particularly containing unusually high numbers of NS records; DNS responses arriving over TCP where UDP would normally suffice (possible TC-bit forcing).
• Application Behavior: Significant and repeated stalls or timeouts in DNS resolution within applications using c-ares; event loop latency spikes of several seconds correlated with DNS response receipt.
• Logs: Application logs showing DNS resolution timeouts or delays clustered around specific query patterns; repeated TCP DNS connections to the same resolver with large response sizes.
• Process: Elevated CPU usage in the c-ares event loop thread during DNS response processing without corresponding network throughput increase (GitHub Advisory).

Upgrade c-ares to version 1.34.7 or later, which caps compression pointer indirections at 128 (ARES_MAX_INDIRS, matching BIND's long-standing behavior) and enforces the RFC 1035 255-octet limit on assembled name length during decompression. The fix is available on both the v1.34 branch (commit 5c8341b, PR #1210) and the main branch (commit f1288bb, PR #1164). There are no known workarounds — the vendor explicitly states that upgrading is the only remediation. Downstream distributions such as Amazon Linux 2023 have issued updated packages (GitHub Advisory, oss-security).

The vulnerability was disclosed by Brad House (c-ares maintainer) via the oss-security mailing list on July 6, 2026, alongside two other c-ares vulnerabilities fixed in the same 1.34.7 release. The Feedly threat intelligence feed noted the CVE as having salience and estimated HIGH severity. Amazon Linux 2023 issued a security advisory (ALAS2023-2026-2060) incorporating the fix. No significant broader media coverage or notable researcher commentary beyond the official disclosure has been identified (oss-security).