CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()`...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
影響パッケージ
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2025-59466 nodejs 修正版: 22.22.2-r0
- Debian DEBIAN-CVE-2025-59466 nodejs
- Ubuntu UBUNTU-CVE-2025-59466 nodejs
参照URL
- advisory nodejs.org
- web nvd.nist.gov