CVE-2025-59466: Node.js Async Hooks DoS Vulnerability

CVE-2025-59466 Overview

A denial-of-service vulnerability has been identified in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates unexpectedly, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Critical Impact

Network-accessible Node.js applications using async hooks can be crashed remotely through crafted requests that trigger deep recursion, bypassing standard exception handling mechanisms and causing complete service disruption.

Affected Products

• Node.js v20.x with AsyncLocalStorage or async_hooks.createHook() enabled
• Node.js v22.x with AsyncLocalStorage or async_hooks.createHook() enabled
• Node.js v24.x with async_hooks.createHook() enabled

Discovery Timeline

• 2026-01-20 - CVE-2025-59466 published to NVD
• 2026-01-30 - Last updated in NVD database

Technical Details for CVE-2025-59466

Vulnerability Analysis

This vulnerability is classified under CWE-248 (Uncaught Exception), affecting the Node.js runtime's ability to properly handle stack overflow conditions when async hooks are active. Under normal circumstances, Node.js applications can catch "Maximum call stack size exceeded" errors using the process.on('uncaughtException') handler, allowing for graceful error recovery or controlled shutdown. However, when async_hooks.createHook() is enabled—either directly or indirectly through AsyncLocalStorage—this safety mechanism fails.

The failure occurs because the async hooks instrumentation interferes with the error propagation path during stack overflow conditions. When the call stack is exhausted, the Node.js runtime attempts to trigger async hook callbacks, but with no remaining stack space, the process terminates immediately without invoking the uncaught exception handler. This creates an unrecoverable crash scenario that attackers can exploit remotely.

Root Cause

The root cause lies in the interaction between Node.js's V8 engine stack overflow detection and the async hooks implementation. When async hooks are registered via async_hooks.createHook(), the runtime attempts to execute hook callbacks during exception handling. In stack overflow scenarios, there is insufficient stack space remaining to execute these callbacks, causing the V8 engine to terminate the process rather than propagating the error to JavaScript exception handlers.

The AsyncLocalStorage API, which is commonly used for request context propagation in web applications, internally uses async_hooks.createHook(), making applications using this popular API automatically vulnerable.

Attack Vector

This vulnerability can be exploited remotely over the network without authentication or user interaction. An attacker can craft HTTP requests or other network inputs designed to trigger deep recursion in vulnerable Node.js applications. Common attack scenarios include:

The attack exploits recursive code paths in web application frameworks or custom route handlers. An attacker sends requests with deeply nested JSON payloads, recursive URL patterns, or parameters that trigger recursive function calls. When the recursion exceeds the stack limit, the application crashes without the ability to recover, resulting in denial of service.

Applications using AsyncLocalStorage for request tracing, logging context, or authentication context propagation are particularly at risk, as this common pattern automatically enables the vulnerable async hooks functionality.

Detection Methods for CVE-2025-59466

Indicators of Compromise

• Unexpected Node.js process terminations without corresponding uncaughtException logs
• Crash dumps showing stack overflow conditions in conjunction with async_hooks callbacks
• Increased process restart frequency in production environments
• Missing error logs for requests that should have generated exception traces

Detection Strategies

• Monitor Node.js process exit codes for unexpected terminations (exit code 7 indicates stack overflow)
• Implement external health checks to detect unresponsive Node.js services
• Review application code for usage of AsyncLocalStorage or direct async_hooks.createHook() calls
• Deploy request payload size and nesting depth validation at the network edge

Monitoring Recommendations

• Configure process managers (PM2, systemd) to alert on repeated rapid restarts
• Implement distributed tracing to identify requests that precede crashes
• Set up memory and CPU monitoring to detect recursive function patterns
• Enable core dump collection for post-mortem analysis of crash conditions

How to Mitigate CVE-2025-59466

Immediate Actions Required

• Update Node.js to the latest patched version addressing this vulnerability
• Review application dependencies for usage of AsyncLocalStorage or async_hooks
• Implement request validation to limit recursion depth in user-controlled inputs
• Configure process managers to automatically restart crashed Node.js processes

Patch Information

Node.js has released security updates addressing this vulnerability. Refer to the Node.js Security Release Blog for detailed patch information and updated versions for the v20.x, v22.x, and v24.x release lines. Organizations should prioritize updating to patched versions as the primary remediation strategy.

Workarounds

• Implement input validation to reject deeply nested JSON structures before processing
• Add recursion depth counters to recursive functions with hard limits
• Deploy a reverse proxy or WAF to filter requests with excessive payload depth
• Consider temporarily disabling AsyncLocalStorage if not critical to application functionality

# Configuration example - Limit JSON parsing depth with Express.js
# Add to your application startup configuration
export NODE_OPTIONS="--max-http-header-size=8192"

# Example nginx configuration to limit request body size
# Add to nginx server block to reduce attack surface
# limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
# client_max_body_size 1m;