AIKIDO-2026-60073

TL;DR

Packet.Name.decode in packet.js follows DNS name compression pointers when decoding names but does not track which pointer offsets it has already visited. A crafted DNS message whose name pointers reference each other in a cycle makes the decoder jump between the same offsets endlessly. Because parsing runs on the single-threaded Node.js event loop, one malformed packet causes an infinite loop that hangs the server or client process handling it. The fix records visited pointer targets in a Set and throws Name decode: pointer cycle detected when a pointer target repeats.