CVE-2025-59466: 
npm vulnerability analysis and mitigation

CVE-2025-59466 is a denial-of-service vulnerability in Node.js caused by uncatchable "Maximum call stack size exceeded" errors when async_hooks.createHook() is enabled. When triggered, the process terminates unrecoverably instead of reaching the process.on('uncaughtException') handler. Affected versions include Node.js 20.x (before 20.20.0), 22.x (before 22.22.0), 24.x (before 24.13.0), and 25.x (before 25.3.0). The vulnerability was reported by Andrew MacPherson (AndrewMohawk) and aaron_vercel, disclosed on January 20, 2026, and patched in the January 13, 2026 security release. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 5.9 (Medium) per the CNA (HackerOne) (Node.js Advisory, Red Hat Bugzilla).

The root cause is improper error handling in Node.js's async_hooks subsystem (CWE-248: Uncaught Exception; CWE-770: Allocation of Resources Without Limits or Throttling). When async_hooks.createHook() is active — including implicitly via AsyncLocalStorage in v20 and v22 — a "Maximum call stack size exceeded" RangeError generated by deep recursion is intercepted by the async hooks machinery before it can reach the application's uncaughtException handler, causing the process to terminate immediately. An unauthenticated remote attacker can exploit this by sending input that triggers deep recursive call chains in the target application, requiring no privileges or user interaction. The Node.js advisory notes that even after patching, recovery from stack space exhaustion remains best-effort behavior, and applications in availability-critical paths should implement input validation and recursion depth limits (Node.js Advisory).

Successful exploitation results in an unrecoverable process crash, causing complete availability loss for the affected Node.js application. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Any application using AsyncLocalStorage (v20, v22) or async_hooks.createHook() (v20, v22, v24, v25) that processes untrusted input influencing recursion depth is at risk, including widely deployed frameworks such as Next.js and APM agents that use these APIs internally (Node.js Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the target application uses async_hooks or AsyncLocalStorage and that an attacker can influence input to trigger deep recursion, which may be non-trivial depending on application logic (Node.js Advisory).

1. Reconnaissance: Identify Node.js applications running versions 20.x, 22.x, 24.x, or 25.x that use AsyncLocalStorage or async_hooks.createHook() — common in APM agents, Next.js, and similar frameworks.
2. Identify recursive input vectors: Analyze the application's API or input handling for endpoints that process deeply nested or recursive data structures (e.g., deeply nested JSON, recursive function calls triggered by user-supplied parameters).
3. Craft a deep-recursion payload: Construct input designed to trigger a call stack depth exceeding the V8 engine's limit (typically ~10,000–15,000 frames), such as a deeply nested JSON object or a recursive request chain.
4. Send the payload: Submit the crafted input to the target endpoint via HTTP or another supported protocol. No authentication is required if the endpoint is public-facing.
5. Observe process termination: Because async_hooks intercepts the RangeError before uncaughtException can handle it, the Node.js process crashes unrecoverably, resulting in a denial of service (Node.js Advisory).

• Logs: Abrupt Node.js process termination without a standard uncaught exception log entry; absence of uncaughtException handler output despite a crash; operating system or process manager logs (e.g., systemd, PM2) showing unexpected Node.js process restarts.
• Process: Node.js process exits with a non-zero exit code without a corresponding application-level error log; repeated rapid restarts of the Node.js service in process managers.
• Network: Unusual volume of requests to endpoints that trigger deep recursive processing, particularly with deeply nested payloads (e.g., deeply nested JSON bodies in POST requests).
• Application Metrics: Sudden drops in application availability or response metrics correlated with process restart events in APM dashboards (Node.js Advisory).

Upgrade Node.js to the patched versions: 20.20.0, 22.22.0, 24.13.0, or 25.3.0, released on January 13, 2026 (Node.js Advisory). Red Hat Enterprise Linux users should apply the relevant errata: RHSA-2026:1842/1843 (RHEL 10), RHSA-2026:2420/2421/2422 (RHEL 8), and RHSA-2026:2781/2782/2783 (RHEL 9) (Red Hat Bugzilla). IBM Cloud Pak for Business Automation and watsonx Orchestrate users should apply the respective IBM security updates. As a workaround prior to patching, implement input validation to bound recursion depth on untrusted input, and avoid designs that allow user-controlled data to drive unbounded recursive call chains. Note that the patch improves recoverability in one edge case but does not fully eliminate the risk of stack exhaustion.

The Node.js security team classified this as a Medium severity issue (despite NVD's High rating), noting that recovery from stack space exhaustion is inherently best-effort and not a reliable security guarantee (Node.js Advisory). The Hacker News and cybersecurity press covered the vulnerability with headlines emphasizing its potential to crash "virtually every" Node.js production app, reflecting concern about the broad use of AsyncLocalStorage in popular frameworks like Next.js and APM tools (The Hacker News). Endor Labs published a technical digest covering this and other vulnerabilities fixed in the same release batch, and Datadog published guidance for APM users specifically affected by the async_hooks dependency (Endor Labs, Datadog Blog). Community discussion on Reddit and security forums highlighted the wide blast radius due to implicit use of AsyncLocalStorage in many frameworks.