CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
| Software | From | Fixed in |
|---|---|---|
| nodejs / node.js | 20.0.0 | 20.20.0 |
| nodejs / node.js | 22.0.0 | 22.22.0 |
| nodejs / node.js | 24.0.0 | 24.13.0 |
| nodejs / node.js | 25.0.0 | 25.3.0 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime