Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2025-59466
Medium 5.9
In plain English
A medium-severity security flaw in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)5.9Medium
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-devel | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-devel | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-devel | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-devel | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-devel | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:10 | nodejs-docs | 1:22.22.0-3.el10_1 | ALSA-2026:1843 |
| AlmaLinux:8 | nodejs-docs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-docs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-docs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-docs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-docs | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:8 | nodejs-full-i18n | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | nodejs-full-i18n | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.20.0-1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-full-i18n | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-libs | 1:22.22.0-1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-libs | 1:24.13.0-0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-libs | 1:22.22.0-1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-libs | 1:24.13.0-1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+3982+85c136aa | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.10.0+4006+3c416519 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.3-1.module_el8.10.0+4061+f8ceeab9 | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.3-3.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.5.0+125+8dc38870 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.6.0+172+f0ba00ec | ALSA-2026:2782 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-5.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4085+6f807d30 | ALSA-2026:2421 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-5.module_el8.10.0+4084+7c0af990 | ALSA-2026:2422 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:2420 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+198+8bf605ba | ALSA-2026:2781 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+196+ac40ca3b | ALSA-2026:2782 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-5.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:10 | nodejs24-docs | 1:24.13.0-1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:10 | nodejs24-npm | 1:11.6.2-1.24.13.0.1.el10_1 | ALSA-2026:1842 |
| AlmaLinux:8 | npm | 1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:8 | npm | 1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | npm | 1:11.6.2-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| AlmaLinux:9 | npm | 1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810 | ALSA-2026:2783 |
| AlmaLinux:9 | npm | 1:10.9.4-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b | ALSA-2026:2421 |
| AlmaLinux:9 | v8-12.4-devel | 3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab | ALSA-2026:2782 |
| AlmaLinux:8 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2 | ALSA-2026:2420 |
| AlmaLinux:9 | v8-13.6-devel | 3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e | ALSA-2026:2781 |
| Alpine:v3.21 | nodejs | 22.22.2-r0 | ALPINE-CVE-2025-59466 |
| Alpine:v3.22 | nodejs | 22.22.0-r0 | ALPINE-CVE-2025-59466 |
| Alpine:v3.23 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-59466 |
| Alpine:v3.24 | nodejs | 24.13.0-r0 | ALPINE-CVE-2025-59466 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u2 | DEBIAN-CVE-2025-59466 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DSA-6166-1 |
| Debian:13 | nodejs | 20.19.2+dfsg-1+deb13u1 | DEBIAN-CVE-2025-59466 |
| Debian:14 | nodejs | 22.22.0+dfsg+~cs22.19.6-1 | DEBIAN-CVE-2025-59466 |
| Rocky Linux:8 | nodejs | 1:22.22.0-1.module+el8.10.0+40078+280dc7ce | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs | 1:20.20.0-1.module+el8.10.0+40077+29236b21 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs | 1:24.13.0-0.module+el8.10.0+40079+1d83e08b | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1988+437f3d23 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+1760+903d54b9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 | RLSA-2026:2420 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2422 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1989+e60144d9 | RLSA-2026:2421 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1824+532140ee | RLSA-2026:2422 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2 | RLSA-2026:2781 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40022+9ecc286c | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40018+a011993d | RLSA-2026:2783 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:2420 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2783 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40050+22a42328 | RLSA-2026:2782 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:2781 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-5.module+el9.7.0+40051+f2ef3f49 | RLSA-2026:2783 |
| Rocky Linux:10 | nodejs22 | 1:22.22.0-3.el10_1 | RLSA-2026:1843 |
| Rocky Linux:10 | nodejs24 | 1:24.13.0-1.el10_1 | RLSA-2026:1842 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-59466 |
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2025-59466 |
| Ubuntu:26.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-59466 |
Affected products (as reported)
Weakness: CWE-248 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H