Skip to content

Commit eca69b4

Browse files
authored
Update apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
1 parent bbf7d27 commit eca69b4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion wi
1313

1414
- **React Server Components** use `AsyncLocalStorage`
1515
- **Next.js** uses `AsyncLocalStorage` for request context tracking
16-
- **Other frameworks** may also use `AsyncLocalStorage` for request context may also be affected
16+
- **Other frameworks** may also use `AsyncLocalStorage` for request context tracking
1717
- **Most APM tools** (Datadog, New Relic, Dynatrace, Elastic APM, OpenTelemetry) use `AsyncLocalStorage` or `async_hooks.createHook` to trace requests
1818

1919
The weakness ultimately lies in the ecosystem's reliance on an unspecified behavior in the language - recovery from stack space exhaustion - for service availability ([CWE-758](https://cwe.mitre.org/data/definitions/758.html)). Given the widespread use of `async_hooks` by popular frameworks and APM tools, the aforementioned edge case can expose this weakness more frequently and can present a Denial‑of‑Service vector for many applications. Node.js shipped a mitigation in the January 2026 security release to make this unspecified behavior more consistent, reducing the chance of reproduction. However, the weakness remains in the ecosystem until applications and frameworks move away from relying on unspecified behavior for availability.

0 commit comments

Comments
 (0)