UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59466

Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers

Severity
High 7.5
Published
13 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.20.0, 22.22.0, 24.13.0, 25.3.0
Sources
NVD, nodejs

Description

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.20.0
  • From 22.0.0 before 22.22.0
  • From 24.0.0 before 24.13.0
  • From 25.0.0 before 25.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59466
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59466
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases