We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejsUpgrade v8-12.4-devel | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs20-npmUpgrade nodejs20-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-docsUpgrade nodejs22-develUpgrade nodejs22-libsUpgrade nodejs20Upgrade nodejs24-docsUpgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs24-debugsourceUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejs22-full-i18nUpgrade nodejs22-docsUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade nodejs20-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs22Upgrade nodejs24-libsUpgrade nodejs24-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs20-develUpgrade nodejs24-debuginfoUpgrade nodejs22-npm | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | May 17, 2026 | May 17, 2026 |
| Oracle_linux | — | Upgrade v8-13.6-develUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs24-devel | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs24-debugsourceUpgrade nodejs-docsUpgrade nodejs24-docsUpgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs24-npmUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs24-develUpgrade nodejs24-debuginfoUpgrade nodejs-npmUpgrade npmUpgrade nodejs22-debuginfoUpgrade nodejsUpgrade nodejs22-debugsource | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade nodejs24-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs24-develUpgrade npmUpgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs22-debuginfoUpgrade v8-12.4-devel | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub