high7.5
CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enable…
Impact
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Node.Js | from 20.0.0 before 20.20.0 from 22.0.0 before 22.22.0 from 24.0.0 before 24.13.0 from 25.0.0 before 25.3.0 |