We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade v8-13.6-develUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-libs | Feb 16, 2026 | Feb 10, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jan 21, 2026 | Jan 20, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-12.4-develUpgrade nodejs24-libsUpgrade nodejs24-debuginfoUpgrade nodejs22-docsUpgrade nodejs20-full-i18nUpgrade nodejs24-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs22-npmUpgrade nodejs22Upgrade nodejs22-debuginfoUpgrade nodejs24Upgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs20-debuginfoUpgrade nodejs24-docsUpgrade nodejs22-develUpgrade nodejs20-docsUpgrade nodejs22-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs20Upgrade nodejs24-debugsourceUpgrade nodejs20-npmUpgrade nodejs22-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs24-devel | Feb 10, 2026 | Jan 20, 2026 |
| Debian | — | Upgrade nodejs | May 17, 2026 | May 17, 2026 |
| Oracle_linux | — | Upgrade nodejs24-develUpgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs24-libsUpgrade nodejs-npmUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs24-docsUpgrade v8-12.4-devel | Feb 9, 2026 | Jan 20, 2026 |
| Redhat_linux | — | Upgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs-libsUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade npmUpgrade nodejs-npmUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs24-debugsource | Feb 6, 2026 | Jan 20, 2026 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs24Upgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-npmUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfo | Feb 9, 2026 | Feb 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub