CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59466?
CVE-2025-59466 has a high severity due to the uncatchable 'Maximum call stack size exceeded' errors that can lead to application crashes.
How do I fix CVE-2025-59466?
To resolve CVE-2025-59466, upgrade Node.js to versions 20.0.0 and above, or 22.0.0 and above where the issue has been patched.
Which Node.js versions are affected by CVE-2025-59466?
CVE-2025-59466 affects Node.js versions between 20.0.0 and 24.0.0, including versions 20.0.0 to 22.0.0.
What happens when CVE-2025-59466 is triggered?
When CVE-2025-59466 is triggered, the process abruptly terminates instead of invoking the usual error handling mechanisms.
Is there a workaround for CVE-2025-59466 if immediate upgrade isn't possible?
An effective workaround for CVE-2025-59466 is to disable async_hooks.createHook() in your Node.js application to prevent uncatchable errors.