5.9
Medium
CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable…
Description
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node | 25.2.1 | No fix stated |
| Node | 24.12.0 | No fix stated |
| Node | 22.21.1 | No fix stated |
| Node | 20.19.6 | No fix stated |
| Node 18.0 | 18.0 → latest | No fix stated |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 16.0 | 16.0 → latest | No fix stated |
| Node 15.0 | 15.0 → latest | No fix stated |
| Node 14.0 | 14.0 → latest | No fix stated |
Show the 6 other branches Hide the 6 other branches
References
- nodejs.org nodejs.org
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when…
6.7
Medium
CVE-2026-105481
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
6.5
Medium