{"schema_version":"2","view":"grouped","data":[{"id":19487,"cve_ids":["CVE-2025-15284"],"payload":{"kind":"patch","title":"Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users","summary":"Node.js released a mitigation for stack exhaustion that could cause immediate process termination when async_hooks is enabled. Upgrade to the patched Node.js versions; applications should also limit attacker-controlled recursion depth.","evidence":"Node.js shipped a mitigation in the January 2026 security release","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[{"value":"when async_hooks are enabled","evidence":"An edge case that reproduces only when async_hooks are enabled"}],"fixed_versions":[{"value":"Node.js 20.20.0 (LTS)","evidence":"Node.js 20.20.0 (LTS)"},{"value":"Node.js 22.22.0 (LTS)","evidence":"Node.js 22.22.0 (LTS)"},{"value":"Node.js 24.13.0 (LTS)","evidence":"Node.js 24.13.0 (LTS)"},{"value":"Node.js 25.3.0 (Current)","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[{"value":"All Node.js versions from 8.x to 18.x","evidence":"All Node.js versions from 8.x to 18.x (8.x was the first version with async_hooks)"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-15284","evidence":"like the recent qs vulnerability CVE-2025-15284 showed"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c0edffc5-fda0-4b91-a995-2d10650cfb3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks","advisory_id":"c0edffc5-fda0-4b91-a995-2d10650cfb3e","event_types":["patch"],"published_at":"2026-10-25T04:25:22.200612+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T17:00:00+00:00","detail_url":"/advisories/advisory%3Ac0edffc5-fda0-4b91-a995-2d10650cfb3e","group":{"id":"advisory:c0edffc5-fda0-4b91-a995-2d10650cfb3e","revision":1,"primary_event_id":19351,"change":"published","superseded_by":[],"changed":{"id":19351,"cve_ids":["CVE-2025-15284"],"payload":{"kind":"patch","title":"Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users","summary":"Node.js released a mitigation for stack exhaustion that could cause immediate process termination when async_hooks is enabled. Upgrade to the patched Node.js versions; applications should also limit attacker-controlled recursion depth.","evidence":"Node.js shipped a mitigation in the January 2026 security release","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[{"value":"when async_hooks are enabled","evidence":"An edge case that reproduces only when async_hooks are enabled"}],"fixed_versions":[{"value":"Node.js 20.20.0 (LTS)","evidence":"Node.js 20.20.0 (LTS)"},{"value":"Node.js 22.22.0 (LTS)","evidence":"Node.js 22.22.0 (LTS)"},{"value":"Node.js 24.13.0 (LTS)","evidence":"Node.js 24.13.0 (LTS)"},{"value":"Node.js 25.3.0 (Current)","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[{"value":"All Node.js versions from 8.x to 18.x","evidence":"All Node.js versions from 8.x to 18.x (8.x was the first version with async_hooks)"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-15284","evidence":"like the recent qs vulnerability CVE-2025-15284 showed"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c0edffc5-fda0-4b91-a995-2d10650cfb3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks","advisory_id":"c0edffc5-fda0-4b91-a995-2d10650cfb3e","event_types":["patch"],"published_at":"2026-10-25T04:25:22.200612+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T17:00:00+00:00","detail_url":"/events/19351"},"members":[{"id":19351,"cve_ids":["CVE-2025-15284"],"payload":{"kind":"patch","title":"Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users","summary":"Node.js released a mitigation for stack exhaustion that could cause immediate process termination when async_hooks is enabled. Upgrade to the patched Node.js versions; applications should also limit attacker-controlled recursion depth.","evidence":"Node.js shipped a mitigation in the January 2026 security release","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.20.0 (LTS)"},"prerequisites":[{"value":"when async_hooks are enabled","evidence":"An edge case that reproduces only when async_hooks are enabled"}],"fixed_versions":[{"value":"Node.js 20.20.0 (LTS)","evidence":"Node.js 20.20.0 (LTS)"},{"value":"Node.js 22.22.0 (LTS)","evidence":"Node.js 22.22.0 (LTS)"},{"value":"Node.js 24.13.0 (LTS)","evidence":"Node.js 24.13.0 (LTS)"},{"value":"Node.js 25.3.0 (Current)","evidence":"Node.js 25.3.0 (Current)"}],"affected_versions":[{"value":"All Node.js versions from 8.x to 18.x","evidence":"All Node.js versions from 8.x to 18.x (8.x was the first version with async_hooks)"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2025-15284","evidence":"like the recent qs vulnerability CVE-2025-15284 showed"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c0edffc5-fda0-4b91-a995-2d10650cfb3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks","advisory_id":"c0edffc5-fda0-4b91-a995-2d10650cfb3e","event_types":["patch"],"published_at":"2026-10-25T04:25:22.200612+00:00","technologies":["node-js","nodejs"],"context_update":false,"extraction_method":"llm","source_published_at":"2026-01-13T17:00:00+00:00","detail_url":"/events/19351"}]}}],"next_after":19487,"next_before":19487}