CVE-2025-59466

EUVD-2026-3339

20.01.2026, 21:16

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 8%

Affected Products (NVD)

Vendor	Product	Version
nodejs	node.js	20.0.0 ≤ 𝑥 < 20.20.0
nodejs	node.js	22.0.0 ≤ 𝑥 < 22.22.0
nodejs	node.js	24.0.0 ≤ 𝑥 < 24.13.0
nodejs	node.js	25.0.0 ≤ 𝑥 < 25.3.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nodejs

bookworm	vulnerable
bookworm (security)	18.20.4+dfsg-1~deb12u2 fixed
bullseye	ignored
bullseye (security)	vulnerable
forky	24.15.0+dfsg+~cs24.12.2-1 fixed
sid	24.15.0+dfsg+~cs24.12.2-1 fixed
trixie	20.19.2+dfsg-1+deb13u2 fixed
trixie (security)	20.19.2+dfsg-1+deb13u2 fixed

openSUSE / SLES Releases

openSUSE Product

Release

nodejs20

suse enterprise server 15 SP5	20.20.0-150500.11.24.1 fixed
suse enterprise server 15 SP6	20.20.0-150600.3.15.1 fixed

nodejs20-devel

suse enterprise server 15 SP5	20.20.0-150500.11.24.1 fixed
suse enterprise server 15 SP6	20.20.0-150600.3.15.1 fixed

nodejs20-docs

suse enterprise server 15 SP5	20.20.0-150500.11.24.1 fixed
suse enterprise server 15 SP6	20.20.0-150600.3.15.1 fixed

nodejs22

suse enterprise sap 15 SP7	22.22.0-150700.3.6.1 fixed
suse enterprise server 15 SP6	22.22.0-150600.13.12.1 fixed
suse enterprise server 15 SP7	22.22.0-150700.3.6.1 fixed

nodejs22-devel

suse enterprise sap 15 SP7	22.22.0-150700.3.6.1 fixed
suse enterprise server 15 SP6	22.22.0-150600.13.12.1 fixed
suse enterprise server 15 SP7	22.22.0-150700.3.6.1 fixed

nodejs22-docs

suse enterprise sap 15 SP7	22.22.0-150700.3.6.1 fixed
suse enterprise server 15 SP6	22.22.0-150600.13.12.1 fixed
suse enterprise server 15 SP7	22.22.0-150700.3.6.1 fixed

npm20

suse enterprise server 15 SP5	20.20.0-150500.11.24.1 fixed
suse enterprise server 15 SP6	20.20.0-150600.3.15.1 fixed

npm22

suse enterprise sap 15 SP7	22.22.0-150700.3.6.1 fixed
suse enterprise server 15 SP6	22.22.0-150600.13.12.1 fixed
suse enterprise server 15 SP7	22.22.0-150700.3.6.1 fixed

Common Weakness Enumeration

CWE-248 - Uncaught Exception
An exception is thrown from a function, but it is not caught.

Vulnerability Media Exposure

[GERMAN] IBM App Connect Enterprise: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
Published: 2026-04-07T22:00:00+00:00

References

https://nodejs.org/en/blog/vulnerability/december-2025-security-releases