[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3323802b-3be3-4bad-8b70-8ff90758407b@oracle.com>
Date: Tue, 13 Jan 2026 16:48:37 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Jan Schaumann <jschauma@...meister.org>
Subject: Re: NodeJS Security Releases (CVE-2025-55131,
CVE-2025-55130, CVE-2025-59465, and others)
On 1/13/26 06:58, Jan Schaumann wrote:
> Uncatchable "Maximum call stack size exceeded" error
> on Node.js via async_hooks leads to process crashes
> bypassing error handlers (CVE-2025-59466) - (Medium)
>
> We have identified a bug in Node.js error handling
> where "Maximum call stack size exceeded" errors become
> uncatchable when async_hooks.createHook() is enabled.
> Instead of reaching process.on('uncaughtException'),
> the process terminates, making the crash
> unrecoverable. Applications that rely on
> AsyncLocalStorage (v22, v20) or
> async_hooks.createHook() (v24, v22, v20) become
> vulnerable to denial-of-service crashes triggered by
> deep recursion under specific conditions.
The node.js team has also published a much more in-depth discussion at:
https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
with a shorter intro in the thread starting at:
https://x.com/matteocollina/status/2011137343323865196
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
