Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow

Du'aine Davis

For awareness

• A Node.js bug affecting all versions using async_hooks caused applications to exit immediately with exit code 7 on stack exhaustion, bypassing normal error handling. This impacted any system where recursion depth could be controlled by user input, including major ecosystems such as React Server Components, Next.js, and widely used APM tools. The issue was disclosed with a January 2026 security release.
• The DoS condition is triggered when an attacker induces deep, unsanitised recursion in user code while async_hooks is enabled. This breaks Node.js’s usual recovery behaviour and forces a hard crash rather than a catchable error. No specific threat actor is named; the vulnerability stems from a logic flaw in Node.js/V8’s handling of stack space exhaustion under async_hooks.
• Organisations should update Node.js immediately to versions including the January 2026 fix, reducing exposure to forced crashes. Developers should implement stronger recursion‑limiting safeguards and avoid relying on recoverable stack overflow behaviour for service availability. Look for behavioural indicators such as unbounded recursion depth, unexpected process exits with code 7, and crashes involving async_hooks/AsyncLocalStorage.

Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users