CVE-2025-59466
Nodejs Node.Js 20.0.0 – 20.20.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-59466 is a high-severity Uncaught Exception (CWE-248) vulnerability in Nodejs Node.Js. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-59466 is a flaw in Node.js error handling that renders "Maximum call stack size exceeded" errors uncatchable when `async_hooks.createHook()` is enabled. Rather than propagating to `process.on('uncaughtException')`, these errors cause the process to terminate abruptly, resulting in unrecoverable crashes. The issue affects applications relying on `AsyncLocalStorage` in Node.js versions 22 and 20, or `async_hooks.createHook()` in versions 24, 22, and 20, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-248.
Unauthenticated remote attackers can exploit this vulnerability by inducing deep recursion under specific conditions in affected applications. Successful exploitation leads to denial-of-service, as the targeted Node.js process crashes without recovery options, disrupting service availability.
The official Node.js December 2025 security releases advisory provides details on patches and mitigation steps: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3339
Vulnerability Data
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20)…
more
or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Security engineering principles include robust exception management to keep the system in a defined state.
Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.
Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uncaught exceptions before production deployment.
Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.
Application security requirements typically mandate robust error and exception handling.
Secure architecture principles call for centralized, comprehensive exception management.
Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.