CVE-2025-59466

Summary

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Affected Software

VendorProductVersion RangeStatus
nodejsnode20.19.6 <= 20.19.6affected
nodejsnode22.21.1 <= 22.21.1affected
nodejsnode24.12.0 <= 24.12.0affected
nodejsnode25.2.1 <= 25.2.1affected
nodejsnode8.0 < 8.*affected
nodejsnode9.0 < 9.*affected
nodejsnode10.0 < 10.*affected
nodejsnode11.0 < 11.*affected
nodejsnode12.0 < 12.*affected
nodejsnode13.0 < 13.*affected
nodejsnode14.0 < 14.*affected
nodejsnode15.0 < 15.*affected
nodejsnode16.0 < 16.*affected
nodejsnode17.0 < 17.*affected
nodejsnode18.0 < 18.*affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References