<h1>Mitigating Node.js Denial-of-Service Vulnerability Related to async_hooks and AsyncLocalStorage</h1>
<p>Node.js has recently addressed a critical denial-of-service vulnerability (CVE-2025-59466) that affects considerable aspects of server-side applications by causing them to crash during stack overflow conditions when using features like async_hooks or AsyncLocalStorage. This vulnerability is notably impacting applications using frameworks and tools such as React Server Components, Next.js, and various Application Performance Monitoring (APM) systems, including Datadog, New Relic, and OpenTelemetry.</p>
<h2>The Vulnerability</h2>
<p>In Node.js versions 8.x through 23.x, enabling <code>async_hooks</code> or <code>AsyncLocalStorage</code> can result in processes exiting unexpectedly with exit code 7 due to stack overflow, instead of throwing a catchable error such as a <code>RangeError</code>. This is attributed to V8’s promise hooks running on the same call stack and not being able to handle stack overflows effectively.</p>
<p>The situation is exacerbated by async_hooks wrapping execution in a way that the runtime’s fatal error handlers intercept these errors as non-recoverable, leading to server crashes when deep recursion occurs.</p>
<h2>Impact and Mitigation</h2>
<p>The implications for production applications are severe. Key tools and frameworks that depend on these mechanisms, such as Datadog’s dd-trace-js tracer, cannot handle these exceptions gracefully under the impacted Node.js versions.</p>
<p>To mitigate this issue, the Node.js project has released patched versions: 25.3.0, 24.13.0, 22.22.0, and 20.20.0. These updates make adjustments to the stack overflow detection mechanism, allowing the overflow errors to be re-thrown to user code, thereby preventing the application from exiting unexpectedly.</p>
<p>While this patch provides an immediate fix, developers are advised against relying on recovering from stack space exhaustion as a reliable defensive measure, given the unspecified nature of such behavior.</p>
<h2>Related Updates</h2>
<p>In tandem with addressing this vulnerability, Node Weekly reports various enhancements to the Node.js ecosystem, such as increased requirements for vulnerability report quality on HackerOne, advancements in Electron with Node’s integrations, and the release of tools like <code>pprof-to-md</code> for profiling.</p>
<p>Many popular JavaScript frameworks and libraries continue to evolve, with milestones such as jQuery’s transition to ES modules and Deno’s ongoing updates, ensuring robust alternatives and complements to Node.js solutions.</p>
<p>In summary, Node.js developers and application operators must upgrade to the latest patched versions to ensure protection from this denial-of-service vulnerability, while staying informed about the evolving tooling and best practices that can fortify their application environments.</p>


Collections

Node.js has patched a critical denial-of-service vulnerability (CVE-2025-59466) affecting versions 8.x through 23.x that causes server crashes when using async_hooks or AsyncLocalStorage during stack overflow conditions. The bug impacts popular frameworks like Next.js and APM tools including Datadog, New Relic, and OpenTelemetry. Patched versions (25.3.0, 24.13.0, 22.22.0, and 20.20.0) now allow stack overflow errors to be re-thrown to user code instead of causing unexpected process exits with code 7. Developers should upgrade immediately to protect production applications.

Node.js Critical Vulnerability Fixed: Mitigating Server Crashes Due to async_hooks Stack Overflow