WhatBrokeToday
Today's Trends
minorInvestigatingNode.js

nodejs/node 2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha) Security Release

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

The nodejs/node version 27.0.0-alpha.0.0.0 was released with a security release that addresses CVE-2026-58042, handling large DNS resolveAny address replies and adding tests for ENODATA states. No specific affected versions or workarounds are provided in the reports.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

1 report · 1 GitHubShow
  1. [1]
    GitHub First report
    nodejs/node 2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS: security release(opens GitHub issue in a new tab)

    \[3e6cca0e6a] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) #64820 \[c558c8e81a] - dns: add tests for ENODATA states (David Evans) #64624 \[116302d950] - dns: address compile-time warnings (Antoine du Hamel) #64355 \[7abbd56cfd] - doc: document the alpha release process (Rafael Gonzaga) #66796 \[ba3c34a93a] - doc: fix grammar and phrasing in typescript.md (Ravi Arnan Irianto) #66977 \[2e4f8cfa20] - doc: add rafael and antoine as last security release stewards…

    by RafaelGSS 25upvotes 0comments

Timeline

  1. First report on GitHub issue

    nodejs/node 2026-10-29, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS: security release

    Source