Bug 2431343 (CVE-2025-59466) - CVE-2025-59466 nodejs: Nodejs denial of service
Summary: CVE-2025-59466 nodejs: Nodejs denial of service
Keywords:
Status: NEW
Alias: CVE-2025-59466
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2431464 2431465 2431466 2431467 2431468 2431469 2431470
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-20 21:02 UTC by OSIDB Bzimport
Modified: 2026-01-21 00:27 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-20 21:02:10 UTC 
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Note You need to log in before you can comment on or make changes to this bug.