On January 13, 2026, Node.js released a security update that fixes a bug where async context tracking caused stack overflows to terminate processes immediately instead of throwing catchable RangeError exceptions. The flaw impacted many production applications and observability tools (including React Server Components, Next.js, Datadog, New Relic, Elastic APM, Dynatrace, and OpenTelemetry) and was patched in Node.js 20.20.0, 22.22.0, 24.13.0, and 25.3.0, though maintainers warned the fix is a mitigation and stack exhaustion remains inherently unreliable to recover from. #Node.js #AsyncLocalStorage
Keypoints
- When async_hooks/AsyncLocalStorage was enabled, a stack overflow could bypass try/catch and uncaughtException handlers and immediately terminate the Node.js process with exit code 7.
- The issue affected a broad portion of the ecosystem because AsyncLocalStorage is used by React Server Components, Next.js, and major APM/observability tools such as Datadog, New Relic, Elastic APM, Dynatrace, and OpenTelemetry.
- Node.js patched the behavior to detect stack overflow errors raised during async_hooks callbacks and rethrow them to user code so a catchable RangeError is returned instead of a fatal process exit.
- The fix shipped in the January 13, 2026 security releases (20.20.0, 22.22.0, 24.13.0, 25.3.0) but maintainers characterized it as a mitigation rather than a guarantee, citing ECMAScript/V8 variability in stack exhaustion handling.
- Node.js 24 and newer are not affected because AsyncLocalStorage was reimplemented using V8’s AsyncContextFrame API; older or EOL releases remain impacted unless updated.
- Maintainers strongly advise developers and hosting providers to validate or limit recursion depth in user-influenced inputs instead of relying on runtime stack-overflow recovery for availability.
MITRE Techniques
- [None ] No MITRE ATT&CK techniques are mentioned in the article – ‘No MITRE ATT&CK techniques are mentioned in the source article.’
Indicators of Compromise
- [Software versions ] Patched release context – Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0 (released January 13, 2026 to address the async_hooks stack overflow behavior)
- [Behavioral indicator ] Crash signature context – process terminated with exit code 7 when a stack overflow occurred during async context tracking