CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()`...
Original description
The description as published by the source.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected packages
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2025-59466 nodejs Fixed in: 22.22.2-r0
- Debian DEBIAN-CVE-2025-59466 nodejs
- Ubuntu UBUNTU-CVE-2025-59466 nodejs
References
- advisory nodejs.org
- web nvd.nist.gov