Node.js Patches Critical DoS Vulnerability Affecting Widespread Ecosystem Node.js has released urgent security updates to address a critical denial-of-service (DoS) vulnerability (CVE-2025-59466, CVSS 7.5) that could crash nearly all production Node.js applications if exploited. The flaw arises when stack space exhaustion occurs in user code while the `async_hooks` API is enabled, causing Node.js to exit abruptly with an error code (7) instead of throwing a catchable exception. The issue stems from a bug in Node.js’s handling of stack overflows in conjunction with `async_hooks`, a low-level API used to track asynchronous operations. Frameworks and Application Performance Monitoring (APM) tools including React Server Components, Next.js, Datadog, New Relic, Dynatrace, Elastic APM, and OpenTelemetry are affected due to their reliance on `AsyncLocalStorage`, a component built on `async_hooks`. The vulnerability impacts all Node.js versions from 8.x (released in 2017) through 18.x, though only supported LTS and current releases have received patches. Fixed versions include: - Node.js 20.20.0 (LTS) - Node.js 22.22.0 (LTS) - Node.js 24.13.0 (LTS) - Node.js 25.3.0 (Current) End-of-life (EoL) versions (8.x–18.x) remain unpatched. The fix rethrows stack overflow errors to user code rather than treating them as fatal, improving error handling predictability. Node.js acknowledged the fix as a mitigation, citing limitations in the ECMAScript specification and V8’s stance on stack exhaustion. Alongside this flaw, Node.js patched three additional high-severity vulnerabilities (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465) enabling data leakage, symlink-based file reads, and remote DoS attacks. The updates underscore the need for prompt upgrades in affected environments.

The attack on Salesloft began with the compromise of an internal GitHub repository, where attackers stole a high-privilege OAuth token granting access to its Drift cloud application. Exploiting Drift’s trusted integrations, the attackers pivoted to Salesforce instances of multiple high-profile customers—including Palo Alto Networks, Cloudflare, Zscaler, and Tenable—exfiltrating customer conversation data, contact details, and sensitive business information. The breach exposed a supply-chain vulnerability, where a single compromised AI-powered integration (Drift’s chatbot) enabled mass data theft across 700+ organizations, including cybersecurity leaders. The attackers also harvested OpenAI API credentials, demonstrating the cascading risks of interconnected AI ecosystems. While companies like Okta mitigated damage via IP allow-listing, others faced reputational harm, forensic costs, and erosion of customer trust. The incident highlighted critical gaps in third-party risk management, token security, and AI integration monitoring, with long-term implications for enterprise security postures.

In August 2025, Dynatrace experienced a third-party breach via Salesloft’s Drift application, which exploited integrations with Salesforce CRM, granting unauthorized access to partial customer data. The exposed information was limited to basic business contact details (e.g., names of customer representatives and company identifiers) stored in Salesforce systems used for business operations. No sensitive customer usage data, Dynatrace products, services, or operational systems (including monitoring/observability) were compromised. The company disabled the Drift integration, launched an investigation with external cybersecurity experts, and confirmed no evidence of broader exposure. While no direct financial or reputational harm was reported, Dynatrace warned customers of potential phishing or social engineering risks leveraging the leaked contact details. Salesloft and Salesforce restored secure connections by September 7, 2025, and Dynatrace continues monitoring for suspicious activity.