We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs24-docsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs24-npmUpgrade v8-13.6-devel | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs20-npmUpgrade nodejs24-develUpgrade nodejs22-libsUpgrade v8-11.3-develUpgrade nodejs20Upgrade nodejs22-develUpgrade nodejs20-libsUpgrade nodejs24-debugsourceUpgrade nodejs20-docsUpgrade nodejs22-full-i18nUpgrade nodejs24-docsUpgrade nodejs20-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-docsUpgrade nodejs20-full-i18nUpgrade nodejs20-develUpgrade nodejs22-npmUpgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs22-debuginfoUpgrade nodejs24-libsUpgrade v8-12.4-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs22Upgrade nodejs20-libs-debuginfoUpgrade nodejs24-full-i18n | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | May 17, 2026 | May 17, 2026 |
| Nodejs | — | Upgrade Node.js to 20.20.0, 22.22.0, 24.13.0 or 25.3.0 or later | Oct 28, 2026 | Jan 20, 2026 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs24-npmUpgrade nodejs-full-i18nUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade npmUpgrade v8-13.6-develUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docs | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-debugsourceUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs24-npmUpgrade nodejs-develUpgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs22-debuginfoUpgrade nodejs24-develUpgrade npmUpgrade nodejs24-debuginfoUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade v8-12.4-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs24-libsUpgrade nodejsUpgrade nodejs24Upgrade nodejs-full-i18nUpgrade nodejs22-debugsourceUpgrade npmUpgrade nodejs24-devel | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub