CVE-2025-59466

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is…

Medium · published January 20, 2026

CVSS v3.0
5.9
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

⚠️ A deep recursion could bring your Node.js app to its knees! When `async_hooks.createHook()` is enabled, a "Maximum call stack size exceeded" error can slip through the cracks, leading to an unrecoverable crash. 🔥 Think of it like a restaurant kitchen that keeps sending out orders without checking if the chef’s stove has enough burners. When the stove overloads, the whole service shuts down — that's what happens with uncatchable errors in your application. In a worst-case scenario, your application could experience a denial-of-service crash, leaving users in the lurch and your service unresponsive. This can happen under specific conditions, especially in apps utilizing `AsyncLocalStorage` or `async_hooks.createHook()`, leading to frustrating downtime.

Put simply

Think of it like a restaurant kitchen that keeps sending out orders without checking if the chef’s stove has enough burners. When the stove overloads, the whole service shuts down — that's what happens with uncatchable errors in your application. The vulnerability stems from the error handling in Node.js, where certain stack overflow errors bypass the normal `process.on('uncaughtException')` handling, causing the process to terminate unexpectedly when deep recursion occurs.

What to do

In a worst-case scenario, your application could experience a denial-of-service crash, leaving users in the lurch and your service unresponsive. This can happen under specific conditions, especially in apps utilizing `AsyncLocalStorage` or `async_hooks.createHook()`, leading to frustrating downtime. To mitigate this issue, avoid using `async_hooks.createHook()` if possible or ensure that your code does not allow for deep recursion. Keep your Node.js version updated to the latest stable release and monitor for patches addressing this bug. You’ve got this! By following these steps, you can keep your application robust and ready to serve. 🛡️

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00683 · 52.0th percentile
Published
2026-01-20T20:41Z
EPSS history
Timeline
  • 20 JAN 20:41Z
    We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is…
    cvelistv5