Node.js Patches Critical DoS Vulnerability Affecting Widespread Ecosystem Node.js has released urgent security updates to address a critical denial-of-service (DoS) vulnerability (CVE-2025-59466, CVSS 7.5) that could crash nearly all production Node.js applications if exploited. The flaw arises when stack space exhaustion occurs in user code while the `async_hooks` API is enabled, causing Node.js to exit abruptly with an error code (7) instead of throwing a catchable exception. The issue stems from a bug in Node.js’s handling of stack overflows in conjunction with `async_hooks`, a low-level API used to track asynchronous operations. Frameworks and Application Performance Monitoring (APM) tools including React Server Components, Next.js, Datadog, New Relic, Dynatrace, Elastic APM, and OpenTelemetry are affected due to their reliance on `AsyncLocalStorage`, a component built on `async_hooks`. The vulnerability impacts all Node.js versions from 8.x (released in 2017) through 18.x, though only supported LTS and current releases have received patches. Fixed versions include: - Node.js 20.20.0 (LTS) - Node.js 22.22.0 (LTS) - Node.js 24.13.0 (LTS) - Node.js 25.3.0 (Current) End-of-life (EoL) versions (8.x–18.x) remain unpatched. The fix rethrows stack overflow errors to user code rather than treating them as fatal, improving error handling predictability. Node.js acknowledged the fix as a mitigation, citing limitations in the ECMAScript specification and V8’s stance on stack exhaustion. Alongside this flaw, Node.js patched three additional high-severity vulnerabilities (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465) enabling data leakage, symlink-based file reads, and remote DoS attacks. The updates underscore the need for prompt upgrades in affected environments.

Security researchers discovered a critical TOCTOU vulnerability in Node.js’s CI/CD infrastructure that allowed attackers to execute malicious code on internal Jenkins agents. An adversary could submit a legitimate pull request, obtain approval and the request-ci label, then push new commits with forged timestamps to bypass code review checks. Once inside the pipeline, the malicious payload could establish persistence in the Jenkins environment, harvest internal credentials and move laterally across build and test systems. A parallel flaw in the commit-queue process might have enabled injection of unreviewed code directly into the main branch, threatening the entire Node.js supply chain. The Node.js security team swiftly restricted access to vulnerable Jenkins runs, rebuilt 24 compromised machines, disabled affected GitHub workflows and replaced timestamp validation with SHA-based checks. They also audited 140 Jenkins jobs to remediate gaps. Although no customer data breach was reported, the incident exposed critical internal infrastructure, credentials and trust in the build process, forcing rapid incident response and infrastructure overhaul.