CVE-2025-59466
Node.js: stack overflow errors become uncatchable with async_hooks
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
>=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0
Upstream Fix
20.20.0; 22.22.0; 24.13.0; 25.3.0
Published
January 20, 2026
OSSeva Coverage
Fixed upstream
Description
With async_hooks.createHook() enabled, "Maximum call stack size exceeded" errors bypass process.on('uncaughtException') and terminate the process. Applications using AsyncLocalStorage on 20 and 22, or async_hooks.createHook() on 20, 22 and 24, can be crashed by deep recursion. Fixed in 20.20.0, 22.22.0, 24.13.0 and 25.3.0.
Is your Node.js deployment affected?
If you're running >=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js >=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?