Post

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

The bug: when async_hooks is enabled and your code hits stack overflow, Node.js exits with code 7 immediately. No try-catch. No uncaughtException handler. Just... dead. The problem? async_hooks is enabled the moment you use AsyncLocalStorage, which is EVERYWHERE.

React Server Components use AsyncLocalStorage. Next.js uses it for request context. Every. Single. APM. Tool. uses it for tracing. This means that an attacker sending deeply nested JSON could crash your entire server with a single request.

The fix detects stack overflow errors and re-throws them to user code instead of treating them as fatal hook errors. Developed with @addaleax and me over the past month after @feedthejim and the React/Next.js teams at Meta and Vercel reported the issue to us.

This is a mitigation, not a guarantee. Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis. If the recursion depth can be controlled by attackers, explicitly limit the depth. This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....

Good news for Node.js 24+ users: AsyncLocalStorage was reimplemented using V8's new AsyncContextFrame API. React/Next.js apps on Node 24+ aren't affected. (APM tools using async_hooks.createHook() directly still are)

Upgrade now: Node.js 20.20.0 Node.js 22.22.0 Node.js 24.13.0 Node.js 25.3.0 Full technical deep dive in our blog post: nodejs.org/en/blog/vuln...

Small suggestion, I would put the note from the blog about all non-maintained lines being impacted *also* in the blog post featured in the banner on the website. nodejs.org/en/blog/vuln... nodejs.org/en/blog/vuln...