CVE-2025-59466
published 2026-01-20CVE-2025-59466: We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.62%
46.2th percentile
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.0+dfsg+~cs22.19.6-1 (forky) | nodejs 22.22.0+dfsg+~cs22.19.6-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | 20.19.6 – 20.19.6 | — |
| nodejs | node | 22.21.1 – 22.21.1 | — |
| nodejs | node | 24.12.0 – 24.12.0 | — |
| nodejs | node | 25.2.1 – 25.2.1 | — |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 20.0.0 < 20.20.0 | 20.20.0 |
| nodejs | node.js | >= 22.0.0 < 22.22.0 | 22.22.0 |
| nodejs | node.js | >= 24.0.0 < 24.13.0 | 24.13.0 |
| nodejs | node.js | >= 25.0.0 < 25.3.0 | 25.3.0 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1+deb13u1 | 20.19.2+dfsg-1+deb13u1 |
| nodejs | nodejs | >= 0 < 22.22.0+dfsg+~cs22.19.6-1 | 22.22.0+dfsg+~cs22.19.6-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs: Nodejs denial of service
vendor_redhat·2026-01-20·CVSS 7.5
CVE-2025-59466 [HIGH] CWE-770 nodejs: Nodejs denial of service
nodejs: Nodejs denial of service
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
A stack overflow flaw has been discovered in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverabl
Debian
CVE-2025-59466: nodejs - We have identified a bug in Node.js error handling where "Maximum call stack siz...
vendor_debian·2025·CVSS 7.5
CVE-2025-59466 [HIGH] CVE-2025-59466: nodejs - We have identified a bug in Node.js error handling where "Maximum call stack siz...
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.0+dfsg+~cs22.19.6-1)
sid: resolved (fixed in 22.22.0+dfsg+~cs22.19.6-1)
trixie: resolved (fixed in 20.19.2+dfsg-1+deb13u1)
OSV
CVE-2025-59466: We have identified a bug in Node
osv·2026-01-20·CVSS 7.5
CVE-2025-59466 [HIGH] CVE-2025-59466: We have identified a bug in Node
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
GHSA
GHSA-52xj-vx8w-46qj: We have identified a bug in Node
ghsa_unreviewed·2026-01-20
CVE-2025-59466 [MEDIUM] CWE-248 GHSA-52xj-vx8w-46qj: We have identified a bug in Node
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-59466 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-59466 [HIGH] CVE-2025-59466 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-59466 :
npm vulnerability analysis and mitigation
async_hooks.createHook()
process.on('uncaughtException')
AsyncLocalStorage
async_hooks.createHook()
Source : NVD
## 7.5
Score
Published January 20, 2026
Severity HIGH
CNA Score 5.9
Affected Technologies
npm
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs20-docs
nodejs:20::nodejs
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity HIGH Has Fix Added at: Jan 23, 2026
Alpine 3.23, ed
Bugzilla
CVE-2025-59466 nodejs18: Nodejs denial of service [fedora-42]
bugzilla·2026-01-21·CVSS 7.5
CVE-2025-59466 [HIGH] CVE-2025-59466 nodejs18: Nodejs denial of service [fedora-42]
CVE-2025-59466 nodejs18: Nodejs denial of service [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version'
to a later Fed
Bugzilla
CVE-2025-59466 nodejs: Nodejs denial of service
bugzilla·2026-01-20·CVSS 7.5
CVE-2025-59466 [HIGH] CVE-2025-59466 nodejs: Nodejs denial of service
CVE-2025-59466 nodejs: Nodejs denial of service
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:1843 https://access.redhat.com/errata/RHSA-2026:1843
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-202
2026-01-20
Published