CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()`...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Paquets affectés
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.20.0"},{"introduced":"21.0.0"},{"fixed":"22.22.0"},{"introduced":"23.0.0"},{"fixed":"24.13.0"},{"introduced":"25.0.0"},{"fixed":"25.3.0"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2025-59466 nodejs Corrigé dans: 22.22.2-r0
- Debian DEBIAN-CVE-2025-59466 nodejs
- Ubuntu UBUNTU-CVE-2025-59466 nodejs
Références
- advisory nodejs.org
- web nvd.nist.gov