Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-59466

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reachin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nodejs node

Default version status: unaffected

  • 20.19.6 to ≤ 20.19.6affected
  • 22.21.1 to ≤ 22.21.1affected
  • 24.12.0 to ≤ 24.12.0affected
  • 25.2.1 to ≤ 25.2.1affected
  • 8.0 to < 8.*affected
  • 9.0 to < 9.*affected
  • 10.0 to < 10.*affected
  • 11.0 to < 11.*affected
  • 12.0 to < 12.*affected
  • 13.0 to < 13.*affected
  • 14.0 to < 14.*affected
  • 15.0 to < 15.*affected
  • 16.0 to < 16.*affected
  • 17.0 to < 17.*affected
  • 18.0 to < 18.*affected

References