REDHAT-BUG-2431343: Medium severity npm/node vulnerability
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when asynchooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or asynchooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2431343?
The severity of REDHAT-BUG-2431343 is medium with a risk score of 4.
What types of software are affected by REDHAT-BUG-2431343?
REDHAT-BUG-2431343 affects Node.js applications using npm/node and npm/@types/node.
How do I fix REDHAT-BUG-2431343?
To mitigate REDHAT-BUG-2431343, consider disabling `async_hooks.createHook()` in your Node.js application until a patch is available.
What causes the issue in REDHAT-BUG-2431343?
The issue in REDHAT-BUG-2431343 occurs when 'Maximum call stack size exceeded' errors become uncatchable, causing the process to terminate instead of being handled by `process.on('uncaughtException')`.
Are there any workarounds for REDHAT-BUG-2431343?
Currently, the recommended workaround for REDHAT-BUG-2431343 is to avoid using the async hooks feature in scenarios where unhandled exceptions may occur.