Post

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

Matteo Collina

@nodeland.dev

The bug: when async_hooks is enabled and your code hits stack overflow, Node.js exits with code 7 immediately. No try-catch. No uncaughtException handler. Just... dead. The problem? async_hooks is enabled the moment you use AsyncLocalStorage, which is EVERYWHERE.

13/1/26, 6:50 pm0 reposts2 likes

Matteo Collina

@nodeland.dev

13 Jan

React Server Components use AsyncLocalStorage. Next.js uses it for request context. Every. Single. APM. Tool. uses it for tracing. This means that an attacker sending deeply nested JSON could crash your entire server with a single request.

Matteo Collina

@nodeland.dev

13 Jan

The fix detects stack overflow errors and re-throws them to user code instead of treating them as fatal hook errors. Developed with @addaleax and me over the past month after @feedthejim and the React/Next.js teams at Meta and Vercel reported the issue to us.

Matteo Collina

@nodeland.dev

13 Jan

This is a mitigation, not a guarantee. Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis. If the recursion depth can be controlled by attackers, explicitly limit the depth. This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....

Matteo Collina

@nodeland.dev

13 Jan

Good news for Node.js 24+ users: AsyncLocalStorage was reimplemented using V8's new AsyncContextFrame API. React/Next.js apps on Node 24+ aren't affected. (APM tools using async_hooks.createHook() directly still are)