Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow

According to Node.js, a critical vulnerability affecting virtually every production Node.js app could cause a denial-of-service if exploited, by causing Node.js to exit with code 7 when async_hooks stack overflows occur. The issue arises because a bug would prevent a catchable error from being thrown during stack exhaustion, meaning applications whose recursion depth is controlled by unsanitized input are vulnerable.

The fix, tracked under CVE-2025-59466 with a CVSS of 7.5, detects stack overflow errors and re-throws them to user code rather than treating them as fatal. The problem impacts multiple frameworks and APM tools that rely on AsyncLocalStorage, including React Server Components, Next.js, Datadog, New Relic, Dynatrace, Elastic APM, and OpenTelemetry.

It affects all Node.js versions from 8.x through 18.x, with unpatched status for those at end-of-life, while updates are available for Node.js 20.20.0 (LTS), 22.22.0 (LTS), 24.13.0 (LTS), and 25.3.0 (Current).