Post

Matteo Collina
@nodeland.dev

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

Matteo Collina
@nodeland.dev

The bug: when async_hooks is enabled and your code hits stack overflow, Node.js exits with code 7 immediately. No try-catch. No uncaughtException handler. Just... dead. The problem? async_hooks is enabled the moment you use AsyncLocalStorage, which is EVERYWHERE.

Matteo Collina
@nodeland.dev

React Server Components use AsyncLocalStorage. Next.js uses it for request context. Every. Single. APM. Tool. uses it for tracing. This means that an attacker sending deeply nested JSON could crash your entire server with a single request.

Matteo Collina
@nodeland.dev

The fix detects stack overflow errors and re-throws them to user code instead of treating them as fatal hook errors. Developed with @addaleax and me over the past month after @feedthejim and the React/Next.js teams at Meta and Vercel reported the issue to us.

0 reposts4 likes

Matteo Collina
@nodeland.dev

This is a mitigation, not a guarantee. Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis. If the recursion depth can be controlled by attackers, explicitly limit the depth. This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....

Matteo Collina
@nodeland.dev

Good news for Node.js 24+ users: AsyncLocalStorage was reimplemented using V8's new AsyncContextFrame API. React/Next.js apps on Node 24+ aren't affected. (APM tools using async_hooks.createHook() directly still are)

Wes
@notwes.bsky.social

Small suggestion, I would put the note from the blog about all non-maintained lines being impacted *also* in the blog post featured in the banner on the website. nodejs.org/en/blog/vuln... nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM UsersNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.