You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md
+3-4Lines changed: 3 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -292,7 +292,7 @@ The complete sequence when stack overflow occurs:
292
292
293
293
The error originated in **user code** (the recursive pattern), but because it manifests while the hook callback is the active frame, it's treated as a fatal hook error.
294
294
295
-
## Why The Is Only a Mitigation, and The Vulnerability Lies Elsewhere
295
+
## Why This Is Only a Mitigation, and The Vulnerability Lies Elsewhere
296
296
297
297
While this issue has significant practical impact, we want to be clear about why Node.js is treating this fix as a mere mitigation of security vulnerability risks at large:
298
298
@@ -304,11 +304,11 @@ It's worth noting that even when ECMAScript specifies that [proper tail calls](h
304
304
305
305
### V8 Doesn't Treat This as a Security Issue
306
306
307
-
Node.js's stack overflow handling is primarily implemented by V8JavaScript engines developed for browsers have a different security model, and they do not treat crashes like this as security vulnerabilities ([example](https://issues.chromium.org/issues/432385241)). This means similar bugs reported in the upstream will not go through vulnerability disclosure procedures, making any security classification by Node.js alone ineffective.
307
+
Node.js's stack overflow handling is primarily implemented by V8. JavaScript engines developed for browsers have a different security model, and they do not treat crashes like this as security vulnerabilities ([example](https://issues.chromium.org/issues/432385241)). This means similar bugs reported in the upstream will not go through vulnerability disclosure procedures, making any security classification by Node.js alone ineffective.
308
308
309
309
### uncaughtException Limitations
310
310
311
-
The `uncaughtException` handler is not designed to recover the process after it fires. The Node.js documentation explicitly warns against this pattern. Specifically, the documentation states that ["Exceptions thrown from within the event handler will not be caught. Instead, the process will exit with a non-zero exit code, and the stack trace will be printed. This is to avoid infinite recursion."](https://nodejs."org/api/process.html#warning-using-uncaughtexception-correctly)
311
+
The `uncaughtException` handler is not designed to recover the process after it fires. The Node.js documentation explicitly warns against this pattern. Specifically, the documentation states that ["Exceptions thrown from within the event handler will not be caught. Instead, the process will exit with a non-zero exit code, and the stack trace will be printed. This is to avoid infinite recursion."](https://nodejs.org/api/process.html#warning-using-uncaughtexception-correctly)
312
312
313
313
Trying to invoke the handler after the call stack size is exceeded would itself throw. The fact that it works without promise hooks is largely coincidental rather than guaranteed behavior.
314
314
@@ -402,7 +402,6 @@ If you cannot upgrade immediately, consider altering your application to avoid d
402
402
403
403
-**December 7, 2025**: React/Next.js team contacted Matteo Collina to report this issue
404
404
-**December 8, 2025**: Vercel Security team opens the [HackerOne report #3456295](https://hackerone.com/reports/3456295)
405
-
-**December 9, 2025**: Vercel Security team opens the [HackerOne report #3456295](https://hackerone.com/reports/3456295)
406
405
-**December 9, 2025**: Matteo Collina starts working on a first patch that would defer the stack overflow error to the next macrotick.
407
406
-**December 10, 2025**: The React/Next.js team validates that this patch did not fix the problem.
408
407
-**December 10, 2025**: Matteo Collina prepares a different patch that rethrow the error immediately, freeing the stack.
0 commit comments