Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2025-59466 — HIGH severity vulnerability | Release Alert

CVE-2025-59466

7.5

HIGHCVSS v3

Published

January 20, 2026

Affected

10 projects

Assigned by

[email protected]

Severity scale

010

Description

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

GitHubThe Externs For Node.JS.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

More on this CVE

NVD↗GitHub Advisory↗

NPM

Mocks Of Built-In Node.JS Modules To Use For Compilation.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

Python Package IndexPython bindings and utils for Node.js and io.js

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

NPM

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

Crates.ioEmbedding Node.js in Rust

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

NPMsecurity holding package

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

>= 20.0.0, < 20.20.0, >= 22.0.0, < 22.22.0, >= 24.0.0, < 24.13.0, >= 25.0.0, < 25.3.0NVD