Skip to content

Commit 72404ca

Browse files
Update apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> Signed-off-by: Matteo Collina <matteo.collina@gmail.com>
1 parent c3e8a38 commit 72404ca

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ React Server Components, Next.js, and virtually every APM tool are affected. The
329329
330330
However, it's important to note that we were fortunate to be able to fix this particular case. There's no guarantee that similar edge cases involving stack overflow and `async_hooks` can always be addressed. **For mission-critical paths that must defend against infinite recursion or stack overflow from recursion whose depth can be controlled by an attacker, always sanitize the input or impose a limit on the depth of recursion by other means**. The runtime cannot guarantee reliable recovery from stack space exhaustion with a catchable error.
331331
332-
It's worth noting that large array allocations can suffer from similar issues, like the recent [`qs`](https://github.com/ljharb/qs) vulnerability [CVE-2025-15284](https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p) showed. It's paramount that developers validate and constrain their inputs.
332+
It's worth noting that large array allocations can suffer from similar issues, like the recent [`qs`](https://github.com/ljharb/qs) vulnerability [CVE-2025-15284](https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p) showed. It's paramount that developers validate and constrain resource usage that could be controlled by an attacker. The runtime cannot always recover reliably from resource exhaustion after-the-fact.
333333
334334
## The Fix
335335

0 commit comments

Comments
 (0)