UnratedFix available
Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users
Node.js released a mitigation for stack exhaustion that could cause immediate process termination when async_hooks is enabled. Upgrade to the patched Node.js versions; applications should also limit attacker-controlled recursion depth.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Node.js shipped a mitigation in the January 2026 security release
Node.js
Node.js 20.20.0 (LTS)
- Affected versions
- All Node.js versions from 8.x to 18.x
All Node.js versions from 8.x to 18.x (8.x was the first version with async_hooks)
- Fixed versions
- Node.js 20.20.0 (LTS)
Node.js 20.20.0 (LTS)
Node.js 22.22.0 (LTS)Node.js 22.22.0 (LTS)
Node.js 24.13.0 (LTS)Node.js 24.13.0 (LTS)
Node.js 25.3.0 (Current)Node.js 25.3.0 (Current)
- Prerequisites
- when async_hooks are enabled
An edge case that reproduces only when async_hooks are enabled
- Related CVEs
- CVE-2025-15284
like the recent qs vulnerability CVE-2025-15284 showed
Publisher severity
No explicit severity was extracted.
- Event
- #19351 · Revision 1
- Added to Heist Feed
- Publisher date