CVE-2025-59466
Published: 20 January 2026
Summary
CVE-2025-59466 is a high-severity Uncaught Exception (CWE-248) vulnerability in Nodejs Node.Js. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote exploitation of Node.js to trigger uncatchable stack overflows, causing unrecoverable process crashes for DoS (T1499.004 Application or System Exploitation).
NVD Description
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20)…
more
or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Deeper analysisAI
CVE-2025-59466 is a flaw in Node.js error handling that renders "Maximum call stack size exceeded" errors uncatchable when `async_hooks.createHook()` is enabled. Rather than propagating to `process.on('uncaughtException')`, these errors cause the process to terminate abruptly, resulting in unrecoverable crashes. The issue affects applications relying on `AsyncLocalStorage` in Node.js versions 22 and 20, or `async_hooks.createHook()` in versions 24, 22, and 20, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-248.
Unauthenticated remote attackers can exploit this vulnerability by inducing deep recursion under specific conditions in affected applications. Successful exploitation leads to denial-of-service, as the targeted Node.js process crashes without recovery options, disrupting service availability.
The official Node.js December 2025 security releases advisory provides details on patches and mitigation steps: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases.
Details
- CWE(s)