CVE-2025-59464

A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.

A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.

Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.

The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.

Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request with a header named __proto__ is received and the application accesses req.headersDistinct. The exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners.

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The issue affects users on version v25.