CVE-2025-59466: High severity npm/node vulnerability
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or asynchooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59466?
CVE-2025-59466 has a high severity due to the uncatchable 'Maximum call stack size exceeded' errors that can lead to application crashes.
How do I fix CVE-2025-59466?
To resolve CVE-2025-59466, upgrade Node.js to versions 20.0.0 and above, or 22.0.0 and above where the issue has been patched.
Which Node.js versions are affected by CVE-2025-59466?
CVE-2025-59466 affects Node.js versions between 20.0.0 and 24.0.0, including versions 20.0.0 to 22.0.0.
What happens when CVE-2025-59466 is triggered?
When CVE-2025-59466 is triggered, the process abruptly terminates instead of invoking the usual error handling mechanisms.
Is there a workaround for CVE-2025-59466 if immediate upgrade isn't possible?
An effective workaround for CVE-2025-59466 is to disable async_hooks.createHook() in your Node.js application to prevent uncatchable errors.