AIKIDO-2026-581496

TL;DR

Affected versions of the package are vulnerable to a denial-of-service condition in dns.resolveAny() when a DNS response contains more than 256 A records. Address/TTL parsing writes into a fixed-size 256-element stack buffer; a larger answer set overruns that buffer and aborts the Node.js process. An attacker who can influence DNS responses, for example via a malicious or compromised resolver, can repeatedly trigger this condition to crash the application. The fix sizes the TTL buffers from the DNS answer count instead of using a fixed 256-slot array.