CVE-2025-59466

score

<0.1

cvss

7.5

epss

0.7%

published

2026-01-20

kev added

—

first seen

2026-10-21

Node.js v20, v22, and v24 contain a denial-of-service vulnerability caused by uncatchable "Maximum call stack size exceeded" errors when async_hooks.createHook() is enabled, letting attackers cause unrecoverable process crashes via deep recursion, exploit requires use of AsyncLocalStorage or async_hooks.createHook().