How does the CAN bus avoid damage when multiple nodes command the bus?
CAN has specifications for leakage currents and for capacitance of each node. More nodes will slow down the edge rate, but edge rates are controlled anyway, to establish a maximum interference. Fast edges will convolve with almost any system and inject energy; slow edges inject less energy thus interfere less, pleasing the FCC and easing EMI certification.

More nodes do load the bus, both with DC leakages and with capacitance. But the bus drivers are designed to handle the increasing capacitance. The receiver has a large minimum noise rejection (0.5 volt), thus across a 60 ohm termination a leakage of 0.5&nbsp;V/ 60&nbsp;Ω = 8&nbsp;mA is tolerated cumulatively.

In recessive, the bus floats and the termination resistors discharge the bus to zero (or near-zero) differential voltage. The transistors connected to the CAN bus are required to survive, without damage, under massive overvoltage conditions such as 42 volts (MCP2551) though only a 12 volt battery be used.

This survive-without-damage is imposed on the transmitter and on the receiver CAN circuits. If all the nodes attempted to impose a dominant state, the maximum voltage imposed would be the battery voltage, which the receiver easily tolerates.