Description (CNA)
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nodejs / node | affected 20.19.6 through 20.19.6; affected 22.21.1 through 22.21.1; affected 24.12.0 through 24.12.0; affected 25.2.1 through 25.2.1; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 18.0 before 18.* |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.