--- title: Node.js — Mitigating Denial-of-Service Vulnerability... description: Node.js released a security patch for a denial-of-service vulnerability affecting applications using async_hooks (including React Server Components, Next.js,... canonical: https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users | daily.dev og:description: Node.js released a security patch for a denial-of-service vulnerability affecting applications using async_hooks (including React Server Components, Next.js,... og:url: https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r og:image: https://api.daily.dev/og/posts/uw83EGG5r.png og:image:alt: Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users **[Node.js](https://daily.dev/sources/nodejs)** · 15 min read · 0 upvotes · 0 comments ## Summary Node.js released a security patch for a denial-of-service vulnerability affecting applications using async_hooks (including React Server Components, Next.js, and all APM tools). When async_hooks is enabled, stack overflow from deep recursion causes immediate process termination with exit code 7 instead of throwing a catchable RangeError. The bug occurs because V8's promise hooks run synchronously on the same call stack as user code, and stack overflow errors are caught by Node.js's fatal error handler. The fix detects stack overflow and re-throws to user code. While patched in versions 20.20.0+, 22.22.0+, 24.13.0+, and 25.3.0+, developers are warned not to rely on recoverable stack overflow for security, as it's unspecified behavior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [OpenTelemetry JS Statement on Node.js DOS Mitigation](https://daily.dev/posts/opentelemetry-js-statement-on-node-js-dos-mitigation-soixdyve6) · OpenTelemetry · 22 upvotes · 0 comments - [Summary of CVE-2026-23864](https://daily.dev/posts/summary-of-cve-2026-23864-igyaclea7) · Vercel · 36 upvotes · 1 comments - [Node.js — Node.js v24.11.1 \(LTS\)](https://daily.dev/posts/node-js-node-js-v24-11-1-lts--cm6gaatbu) · Node.js · 83 upvotes · 3 comments - [React Denial-of-Service flaw \+ code leak join React2Shell vulnerability in Server Components and more – Dev Weekly \#91](https://daily.dev/posts/react-denial-of-service-flaw-code-leak-join-react2shell-vulnerability-in-server-components-and-mor-pgx98u8iz) · The Miners · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#performance](https://daily.dev/tags/performance), [#nodejs](https://daily.dev/tags/nodejs), [#nextjs](https://daily.dev/tags/nextjs) [View this post on daily.dev](https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users","url":"https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r"},"datePublished":"2026-01-13T17:43:37.826Z","dateModified":"2026-02-28T03:57:55.218Z","description":"Node.js released a security patch for a denial-of-service vulnerability affecting applications using async_hooks (including React Server Components, Next.js,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/20cefd609636bc3de11616f29ae64550?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/20cefd609636bc3de11616f29ae64550?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Node.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Node.js","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/nodejs","url":"https://daily.dev/sources/nodejs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/node-js-mitigating-denial-of-service-vulnerability-from-unrecoverable-stack-space-exhaustion-for-r-uw83egg5r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,react,performance,nodejs,nextjs","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Node.js","item":"https://daily.dev/sources/nodejs"},{"@type":"ListItem","position":3,"name":"Node.js — Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users"}]} ```