Cloudanix VulnDB

CVE-2025-59466

High · 7.5

CVSS

7.5

EPSS

0.7%

Published

Jan 20, 2026

CISA due date

—

The record

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami node 0 20.20.0
Bitnami node-min 0 20.20.0
Chainguard nodejs-16 0 16.20.2-r16
Chainguard nodejs-20 0 20.20.0-r0
Chainguard nodejs-20-doc 0 20.20.0-r0
Chainguard nodejs-22 0 22.22.0-r0
Chainguard nodejs-22-doc 0 22.22.0-r0
Chainguard nodejs-24 0 24.13.0-r0
Chainguard nodejs-24-doc 0 24.13.0-r0
Chainguard nodejs-25 0 25.3.0-r0
Mageia:9 nodejs 0 22.22.0-1.mga9
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs22 0 22.22.0-150600.13.12.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs22 0 22.22.0-150600.13.12.1
Wolfi nodejs-16 0 16.20.2-r16
Wolfi nodejs-20 0 20.20.0-r0
Wolfi nodejs-20-doc 0 20.20.0-r0
Wolfi nodejs-22 0 22.22.0-r0
Wolfi nodejs-22-doc 0 22.22.0-r0
Wolfi nodejs-24 0 24.13.0-r0
Wolfi nodejs-24-doc 0 24.13.0-r0
Wolfi nodejs-25 0 25.3.0-r0
openSUSE:Leap 15.6 nodejs20 0 20.20.0-150600.3.15.1
openSUSE:Leap 15.6 nodejs22 0 22.22.0-150600.13.12.1
openSUSE:Leap 16.0 nodejs22 0 22.22.0-160000.1.1
openSUSE:Tumbleweed nodejs22 0 22.22.0-1.1
openSUSE:Tumbleweed nodejs24 0 24.13.0-1.1
openSUSE:Tumbleweed nodejs26 0 26.3.1-1.1

Related vulnerabilities