Post

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

The bug: when async_hooks is enabled and your code hits stack overflow, Node.js exits with code 7 immediately. No try-catch. No uncaughtException handler. Just... dead. The problem? async_hooks is enabled the moment you use AsyncLocalStorage, which is EVERYWHERE.

The fix detects stack overflow errors and re-throws them to user code instead of treating them as fatal hook errors. Developed with @addaleax and me over the past month after @feedthejim and the React/Next.js teams at Meta and Vercel reported the issue to us.

This is a mitigation, not a guarantee. Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis. If the recursion depth can be controlled by attackers, explicitly limit the depth. This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....

Good news for Node.js 24+ users: AsyncLocalStorage was reimplemented using V8's new AsyncContextFrame API. React/Next.js apps on Node 24+ aren't affected. (APM tools using async_hooks.createHook() directly still are)