Fluid Attacks Database

Description

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on('uncaughtException'), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel9	nodejs	<1:20.20.0-1.module+el9.7.0+23895+0637d423	1:20.20.0-1.module+el9.7.0+23895+0637d423
rpm rhel10	nodejs22	<1:22.22.0-3.el10_1	1:22.22.0-3.el10_1
debian 12	nodejs	=18.13.0+dfsg1-1 \|\| =18.13.0+dfsg1-1.1 \|\| =18.19.0+dfsg-1 \|\| =18.19.0+dfsg-2 \|\| =18.19.0+dfsg-3 \|\| =18.19.0+dfsg-4 \|\| =18.19.0+dfsg-5 \|\| =18.19.0+dfsg-6 \|\| =18.19.0+dfsg-6~deb12u1 \|\| =18.19.0+dfsg-6~deb12u2 \|\| =18.19.1+dfsg-1 \|\| =18.19.1+dfsg-2 \|\| =18.19.1+dfsg-3 \|\| =18.19.1+dfsg-3.1 \|\| =18.19.1+dfsg-4 \|\| =18.19.1+dfsg-6 \|\| =18.20.1+dfsg-1 \|\| =18.20.1+dfsg-2 \|\| =18.20.1+dfsg-3 \|\| =18.20.1+dfsg-4 \|\| =18.20.4+dfsg-1~deb12u1 \|\| >=0 <18.20.4+dfsg-1~deb12u2	18.20.4+dfsg-1~deb12u2
debian 13	nodejs	=20.19.2+dfsg-1 \|\| >=0 <20.19.2+dfsg-1+deb13u1	20.19.2+dfsg-1+deb13u1
debian 14	nodejs	=20.19.2+dfsg-1 \|\| =20.19.4+dfsg-1 \|\| =20.19.5+dfsg+~cs20.19.12-1 \|\| =20.19.5+dfsg+~cs20.19.12-2 \|\| =20.19.5+dfsg+~cs20.19.12-3 \|\| =20.19.5+dfsg+~cs20.19.12-4 \|\| =20.19.5+dfsg+~cs20.19.24-1 \|\| =22.12.0+dfsg-1 \|\| =22.12.0+dfsg-2 \|\| =22.12.0+dfsg-3 \|\| =22.14.0+dfsg-1 \|\| =22.18.0+dfsg+~cs22.17.2-1 \|\| =22.18.0+dfsg+~cs22.17.2-2 \|\| =22.18.0+dfsg-1 \|\| =22.19.0+dfsg+~cs22.18.0-1 \|\| =22.21.1+dfsg+~cs22.19.0-1 \|\| =22.21.1+dfsg+~cs22.19.0-2 \|\| =22.21.1+dfsg+~cs22.19.0-3 \|\| =22.21.1+dfsg+~cs22.19.0-4 \|\| =22.21.1+dfsg+~cs22.19.0-5 \|\| =22.21.1+dfsg+~cs22.19.0-6 \|\| >=0 <22.22.0+dfsg+~cs22.19.6-1	22.22.0+dfsg+~cs22.19.6-1
alpine v3.23	nodejs	>=0 <24.13.0-r0	24.13.0-r0
alpine v3.22	nodejs	>=0 <22.22.0-r0	22.22.0-r0
rpm rhel8	nodejs	<1:20.20.0-1.module+el8.10.0+23905+c49b2aec	1:20.20.0-1.module+el8.10.0+23905+c49b2aec
rpm rhel10	nodejs24	<1:24.13.0-1.el10_1	1:24.13.0-1.el10_1
alpine v3.21	nodejs	>=0 <22.22.2-r0	22.22.2-r0

1-10 of 15

Aliases

1. CVE-2025-594662. NVD-2025-594663. OSV-2025-594664. OSV-DEBIAN-2025-594665. OSV-ALPINE-2025-594666. GCVE-2025-594667. SECURITY-TRACKER-CVE-2025-594668. SECURITY-CVE-2025-594669. https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59466.json

References

1. https://nodejs.org/en/blog/vulnerability/december-2025-security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.