diff --git a/CHANGES b/CHANGES
index 27848a6f95..88e3dc01c2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5948.	[bug]		Fix nsec3.c:dns_nsec3_activex() function, add a missing
+			dns_db_detachnode() call. [GL #3500]
+
 5947.	[func]		Change dnssec-policy to allow graceful transition from
 			an NSEC only zone to NSEC3. [GL #3486]
 
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index fca6459343..253de1cab7 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -1830,6 +1830,7 @@ dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version, bool complete,
 
 try_private:
 	if (privatetype == 0 || complete) {
+		dns_db_detachnode(db, &node);
 		*answer = false;
 		return (ISC_R_SUCCESS);
 	}