dns,net: reject hostnames with embedded NUL bytes

Ref: https://hackerone.com/reports/3656716
PR-URL: nodejs-private/node-private#868
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716

Author: mcollina

lib/dns.js

@@ -84,7 +84,7 @@ const {
  validateNumber,
  validateOneOf,
  validatePort,
-validateString,
+validateStringWithoutNullBytes,
 }=require('internal/validators');
 
 const{
@@ -148,7 +148,7 @@ function lookup(hostname, options, callback) {
 
 // Parse arguments
 if(hostname){
-validateString(hostname,'hostname');
+validateStringWithoutNullBytes(hostname,'hostname');
 }
 
 if(typeofoptions==='function'){

lib/internal/dns/promises.js

@@ -71,6 +71,7 @@ const {
  validateOneOf,
  validatePort,
  validateString,
+ validateStringWithoutNullBytes,
 }=require('internal/validators');
 
 constkPerfHooksDnsLookupContext=Symbol('kPerfHooksDnsLookupContext');
@@ -201,7 +202,7 @@ function lookup(hostname, options) {
 
 // Parse arguments
 if(hostname){
-validateString(hostname,'hostname');
+validateStringWithoutNullBytes(hostname,'hostname');
 }
 
 if(typeofoptions==='number'){

lib/internal/validators.js

@@ -16,6 +16,7 @@ const {
  ObjectPrototypeHasOwnProperty,
  RegExpPrototypeExec,
  String,
+ StringPrototypeIncludes,
  StringPrototypeToUpperCase,
  StringPrototypeTrim,
 }=primordials;
@@ -165,6 +166,14 @@ const validateString = hideStackFrames((value, name) => {
 thrownewERR_INVALID_ARG_TYPE(name,'string',value);
 });
 
+/** @type {validateString} */
+constvalidateStringWithoutNullBytes=hideStackFrames((value,name)=>{
+validateString(value,name);
+if(StringPrototypeIncludes(value,'\u0000')){
+thrownewERR_INVALID_ARG_VALUE(name,value,'must be a string without null bytes');
+}
+});
+
 /**
  * @callback validateNumber
  * @param {*} value
@@ -677,6 +686,7 @@ module.exports = {
  validatePort,
  validateSignalName,
  validateString,
+ validateStringWithoutNullBytes,
  validateUint32,
  validateUndefined,
  validateUnion,

lib/net.js

@@ -135,6 +135,7 @@ const {
  validateNumber,
  validatePort,
  validateString,
+ validateStringWithoutNullBytes,
 }=require('internal/validators');
 constkLastWriteQueueSize=Symbol('lastWriteQueueSize');
 const{ getOptionValue }=require('internal/options');
@@ -1371,7 +1372,7 @@ function lookupAndConnect(self, options) {
 consthost=options.host||'localhost';
 let{ port, autoSelectFamilyAttemptTimeout, autoSelectFamily }=options;
 
-validateString(host,'options.host');
+validateStringWithoutNullBytes(host,'options.host');
 
 if(localAddress&&!isIP(localAddress)){
 thrownewERR_INVALID_IP_ADDRESS(localAddress);

test/parallel/test-dns-lookup.js

@@ -23,6 +23,17 @@ const dnsPromises = dns.promises;
 assert.throws(()=>dnsPromises.lookup(1,{}),err);
 }
 
+{
+consterr={
+code: 'ERR_INVALID_ARG_VALUE',
+name: 'TypeError',
+message: /Theargument'hostname'mustbeastringwithoutnullbytes\./,
+};
+
+assert.throws(()=>dns.lookup('127.0.0.1\u0000.allowed.example',{}),err);
+assert.throws(()=>dnsPromises.lookup('127.0.0.1\u0000.allowed.example',{}),err);
+}
+
 // This also verifies different expectWarning notations.
 common.expectWarning({
 // For 'internal/test/binding' module.

test/parallel/test-net-connect-options-invalid.js

@@ -37,3 +37,16 @@ const net = require('net');
 name: 'TypeError',
 });
 }
+
+{
+assert.throws(()=>{
+net.createConnection({
+host: '127.0.0.1\u0000.allowed.example',
+port: 8080,
+});
+},{
+code: 'ERR_INVALID_ARG_VALUE',
+name: 'TypeError',
+message: /Theproperty'options\.host'mustbeastringwithoutnullbytes\./,
+});
+}