We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become uncatchable when async_hooks.createHook() is enabled. Instead of reaching process.on(uncaughtException), the process terminates, making the crash unrecoverable. Applications that rely on AsyncLocalStorage (v22, v20) or async_hooks.createHook() (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Weakness
An exception is thrown from a function, but it is not caught.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | 20.0.0 (including) | 20.20.0 (excluding) |
| Node.js | Nodejs | 22.0.0 (including) | 22.22.0 (excluding) |
| Node.js | Nodejs | 24.0.0 (including) | 24.13.0 (excluding) |
| Node.js | Nodejs | 25.0.0 (including) | 25.3.0 (excluding) |
| Nodejs | Ubuntu | plucky | * |
| Nodejs | Ubuntu | upstream | * |