Skip to content

dns: handle large resolveAny address replies - #64820

Closed
RafaelGSS wants to merge 1 commit into
nodejs:mainfrom
RafaelGSS:dnsresolve-to-main
Closed

dns: handle large resolveAny address replies#64820
RafaelGSS wants to merge 1 commit into
nodejs:mainfrom
RafaelGSS:dnsresolve-to-main

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Jul 29, 2026

Copy link
Copy Markdown
Member

Refs: https://hackerone.com/reports/3795657

PR-URL: https://github.com/nodejs-private/node-private/pull/929
Reviewed-By: Matteo Collina matteo.collina@gmail.com
CVE-ID: CVE-2026-58042

It landed on v26.x (and all release lines), but conflicted with main.

PTAL @mcollina

@RafaelGSS
dns: handle large resolveAny address replies
b6f32f5 
Refs: https://hackerone.com/reports/3795657
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#929
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-58042
@nodejs-github-bot

nodejs-github-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/net

@RafaelGSS RafaelGSS added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. labels Jul 29, 2026
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. cares Issues and PRs related to the c-ares dependency or the cares_wrap binding. needs-ci PRs that need a full CI run. labels Jul 29, 2026
mcollina
mcollina approved these changes Jul 29, 2026
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina added fast-track PRs that do not need to wait for 48 hours to land. request-ci Add this label to start a Jenkins CI on a PR. labels Jul 29, 2026
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Fast-track has been requested by @mcollina. Please 👍 to approve.

@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2026
@nodejs-github-bot

nodejs-github-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75292/

@avivkeller avivkeller added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jul 29, 2026
@codecov

codecov Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 70.83333% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.14%. Comparing base (41525ab) to head (b6f32f5).
⚠️ Report is 76 commits behind head on main.

Files with missing lines Patch % Lines
src/cares_wrap.cc 70.83% 1 Missing and 6 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #64820      +/-   ##
==========================================
- Coverage   90.16%   90.14%   -0.02%     
==========================================
  Files         746      746              
  Lines      242660   242832     +172     
  Branches    45720    45763      +43     
==========================================
+ Hits       218793   218909     +116     
- Misses      15360    15410      +50     
- Partials     8507     8513       +6
Files with missing lines Coverage Δ
src/cares_wrap.cc 63.07% <70.83%> (+0.14%) ⬆️

... and 46 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@nodejs-github-bot

nodejs-github-bot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75304/

@panva panva added the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 2, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Aug 2, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 2, 2026

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/64820
✔  Done loading data for nodejs/node/pull/64820
----------------------------------- PR info ------------------------------------
Title      dns: handle large resolveAny address replies (#64820)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:dnsresolve-to-main -> nodejs:main
Labels     c++, cares, fast-track, author ready, needs-ci, dont-land-on-v22.x, dont-land-on-v24.x, dont-land-on-v26.x
Commits    1
 - dns: handle large resolveAny address replies
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/64820
Refs: https://hackerone.com/reports/3795657
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64820
Refs: https://hackerone.com/reports/3795657
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Wed, 29 Jul 2026 14:16:43 GMT
   ✔  Approvals: 3
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/64820#pullrequestreview-4809707254
   ✔  - Aviv Keller (@avivkeller): https://github.com/nodejs/node/pull/64820#pullrequestreview-4810321965
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/64820#pullrequestreview-4812530901
   ℹ  This PR is being fast-tracked
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-07-30T11:03:18Z: https://ci.nodejs.org/job/node-test-pull-request/75304/
- Querying data for job/node-test-pull-request/75304/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/30771420079

@mcollina mcollina added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels Aug 3, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Aug 3, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/64820
✔  Done loading data for nodejs/node/pull/64820
----------------------------------- PR info ------------------------------------
Title      dns: handle large resolveAny address replies (#64820)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:dnsresolve-to-main -> nodejs:main
Labels     c++, cares, fast-track, author ready, needs-ci, dont-land-on-v22.x, dont-land-on-v24.x, dont-land-on-v26.x
Commits    1
 - dns: handle large resolveAny address replies
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/64820
Refs: https://hackerone.com/reports/3795657
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64820
Refs: https://hackerone.com/reports/3795657
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Wed, 29 Jul 2026 14:16:43 GMT
   ✔  Approvals: 3
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/64820#pullrequestreview-4809707254
   ✔  - Aviv Keller (@avivkeller): https://github.com/nodejs/node/pull/64820#pullrequestreview-4810321965
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/64820#pullrequestreview-4812530901
   ℹ  This PR is being fast-tracked
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-08-02T23:04:02Z: https://ci.nodejs.org/job/node-test-pull-request/75304/
- Querying data for job/node-test-pull-request/75304/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/30799387850

@RafaelGSS

RafaelGSS commented Aug 5, 2026

Copy link
Copy Markdown
Member Author

Landed in 3e6cca0

RafaelGSS added a commit that referenced this pull request Aug 5, 2026
@RafaelGSS
dns: handle large resolveAny address replies
3e6cca0 
Refs: https://hackerone.com/reports/3795657
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-58042
PR-URL: #64820
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@RafaelGSS RafaelGSS closed this Aug 5, 2026
@RafaelGSS RafaelGSS removed the commit-queue-failed An error occurred while landing this pull request using GitHub Actions. label Aug 5, 2026
@aduh95 aduh95 added backported-to-v22.x PRs backported to the v22.x-staging branch. backported-to-v24.x PRs backported to the v24.x-staging branch. backported-to-v26.x PRs backported to the v26.x-staging branch. and removed dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. labels Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollina mcollina mcollina approved these changes
@lpinca lpinca lpinca approved these changes
@avivkeller avivkeller avivkeller approved these changes

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. backported-to-v22.x PRs backported to the v22.x-staging branch. backported-to-v24.x PRs backported to the v24.x-staging branch. backported-to-v26.x PRs backported to the v26.x-staging branch. c++ Issues and PRs that require attention from people who are familiar with C++. cares Issues and PRs related to the c-ares dependency or the cares_wrap binding. fast-track PRs that do not need to wait for 48 hours to land. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@RafaelGSS @nodejs-github-bot @mcollina @lpinca @avivkeller @panva @aduh95