javascript can't stop winning

Quick Overview

A Denial-of-Service (DoS) vulnerability in Node.js versions prior to 20.20.0, 22.22.0, 24.13.0, and 25.3.0, caused by stack overflow errors during deep recursion when using asynchooks, is mitigated by patching Node.js, as the error was being treated as a non-recoverable fatal error instead of being re-thrown to user code for graceful handling.

Key Points: The vulnerability stems from unrecoverable stack space exhaustion caused by deep recursion when asynchooks are used, leading Node.js to exit immediately with code 7 instead of allowing try-catch blocks to handle the RangeError. The issue specifically affects applications using asynchooks, including React Server Components, Next.js, and most Application Performance Monitoring (APM) tools that rely on async context tracking via AsyncLocalStorage or similar mechanisms. Node.js V8 treats asynchooks callbacks as fatal errors (kFatal) wrapped in a TryCatchScope, causing process exit upon stack overflow, which bypasses standard unhandled exception handlers. ECMAScript specifies that proper tail calls should reuse stack frames, but V8 does not implement this, meaning deep recursion consumes stack space, leading to the overflow. The fix implemented in Node.js security releases checks if the caught error is a stack overflow error and, if so, re-throws it as a standard error allowing user-level try-catch blocks to handle it gracefully, rather than exiting fatally. Patched releases include Node.js 20.20.0 (LTS), 22.22.0 (LTS), 24.13.0 (LTS), and 25.3.0 (Current) as of January 13, 2026. The vulnerability is a DoS vector, not a security vulnerability in the V8 engine itself, as V8 handles stack overflow as an unspecified behavior, not a security issue.

Context: This video analyzes a critical Denial-of-Service (DoS) vulnerability discussed in a Node.js security blog post, authored by Matteo Collina and Joyee Cheung. The vulnerability specifically targets applications utilizing the API, which is heavily relied upon by modern frameworks like React Server Components and Next.js, as well as various Application Performance Monitoring (APM) tools, for tracking asynchronous context across operations. The core problem arises when deep, recursive operations exhaust the call stack, causing Node.js to exit abruptly instead of recovering.