A severe security flaw affecting “virtually every production Node.js app” that, if properly exploited, may result in a denial-of-service (DoS) condition has been fixed by Node.js through upgrades.
In a Tuesday bulletin, Matteo Collina and Joyee Cheung of Node.js stated that Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have grown to rely on for service availability.
This attempt would be thwarted by a flaw that only occurs when async_hooks are utilized, which would cause Node.js to exit with 7 without generating a catchable error when user code recursions exhaust the stack space. Applications that rely on unsanitized input to manage their recursion depth are therefore susceptible to denial-of-service attacks.
The fundamental flaw is that when a stack overflow happens in user code while async_hooks is enabled, Node.js quits with code 7, which indicates an Internal issue Handler Run-Time Failure, rather than resolving the issue gracefully. Developers may monitor the lifespan of asynchronous resources read more about Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.