Post

Matteo Collina
@nodeland.dev

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

20 reposts78 likes

Matteo Collina
@nodeland.dev

The bug: when async_hooks is enabled and your code hits stack overflow, Node.js exits with code 7 immediately. No try-catch. No uncaughtException handler. Just... dead. The problem? async_hooks is enabled the moment you use AsyncLocalStorage, which is EVERYWHERE.

Matteo Collina
@nodeland.dev

React Server Components use AsyncLocalStorage. Next.js uses it for request context. Every. Single. APM. Tool. uses it for tracing. This means that an attacker sending deeply nested JSON could crash your entire server with a single request.

Matteo Collina
@nodeland.dev

The fix detects stack overflow errors and re-throws them to user code instead of treating them as fatal hook errors. Developed with @addaleax and me over the past month after @feedthejim and the React/Next.js teams at Meta and Vercel reported the issue to us.

Matteo Collina
@nodeland.dev

This is a mitigation, not a guarantee. Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis. If the recursion depth can be controlled by attackers, explicitly limit the depth. This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....