Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow
Summary: Node.js released updates for a critical flaw, tracked as CVE-2025-59466 with a CVSS score of 7.5, in which a stack overflow in user code while async_hooks is enabled causes Node.js to exit with code 7 instead of throwing a catchable error, enabling denial-of-service attacks where recursion depth is controlled by unsanitized input. Node.js said the issue affects React Server Components, Next.js, Datadog, New Relic, Dynatrace, Elastic APM, and OpenTelemetry through their use of AsyncLocalStorage, and impacts all versions from 8.x through 18.x, which remain unpatched as end-of-life releases.
What's compelling: Node.js called this a critical issue affecting virtually every production Node.js app, and the affected list includes the APM tools most teams rely on to notice an outage - the fix is being treated as a mitigation, not a full resolution.
Read the original at The Hacker News ↗
- Mentions
- CVE-2025-55130CVE-2025-55131CVE-2025-59465CVE-2025-59466
- Related