Update apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md

Co-authored-by: Joyee Cheung <[email protected]>
Signed-off-by: Matteo Collina <[email protected]>

Author: mcollina

apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md

@@ -1,5 +1,5 @@
 ---
-date: 2026-01-08T17:00:00.000Z
+date: 2026-01-13T17:00:00.000Z
 category: vulnerability
 title: Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users
 slug: january-2026-dos-mitigation-async-hooks
@@ -327,7 +327,7 @@ The irony is notable: the tools you install to monitor and debug crashes can mak
 Although it is a bug fix for an unspecified behavior, we chose to include it in the security release because of its widespread impact on the ecosystem.
 React Server Components, Next.js, and virtually every APM tool are affected. The fix improves developer experience and makes error handling more predictable.
 
-However, it's important to note that we were fortunate to be able to fix this particular case. There's no guarantee that similar edge cases involving stack overflow and `async_hooks` can always be addressed. **For mission-critical paths that must defend against infinite recursion or stack overflow from recursion whose depth can be controlled by an attacker, always sanitize the input or impose a limit on the depth of recursion by other means**. The runtime cannot guarantee reliable recovery from stack space exhaustion with a catchable error.
+However, it's important to note that we were fortunate to be able to fix this particular case. There's no guarantee that similar edge cases involving stack overflow and `async_hooks` can always be addressed. **For mission-critical paths that must defend against infinite recursion or stack overflow from recursion whose depth can be controlled by an attacker, always sanitize the input or impose a limit on the depth of recursion by other means**.
 
 It's worth noting that large array allocations can suffer from similar issues, like the recent [`qs`](https://github.com/ljharb/qs) vulnerability [CVE-2025-15284](https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p) showed. It's paramount that developers validate and constrain resource usage that could be controlled by an attacker. The runtime cannot always recover reliably from resource exhaustion after-the-fact.
 
@@ -394,7 +394,7 @@ The impact on React Server Components and Next.js varies by Node.js version:
 
 ## Mitigation
 
-**Recommended**: Upgrade to the patched versions released on January 8th, 2026.
+**Recommended**: Upgrade to the patched versions released on January 13th, 2026.
 
 If you cannot upgrade immediately, consider altering your application to avoid deep recursion, particularly when allocating promises within recursive functions.
 
@@ -409,15 +409,15 @@ If you cannot upgrade immediately, consider altering your application to avoid d
 - **December 12, 2025**: Anna Henningsen identifies a blocker for this strategy. The Node.js team starts brainstorming on alternative solutions.
 - **December 16, 2025**: Joyee Cheung communicates that Node.js cannot treat this as a vulnerability for the reasons listed in this blog post.
 - **December 17, 2025**: Anna Henningsen fixes the blocking issue for the patch.
-- **January 8, 2026**: Patched versions released and disclosure published
+- **January 13, 2026**: Patched versions released and disclosure published
 
 ## Conclusion
 
 This bug highlights how deeply `async_hooks` has become embedded in the Node.js ecosystem. What started as a low-level debugging API is now a critical dependency for React Server Components, Next.js, every major APM tool, and any code using `AsyncLocalStorage`.
 
 The fix improves the consistency of stack size limit errors caused by deep recursions. While we were able to address this particular case, developers should be aware that stack overflow behavior is not specified by ECMAScript and should not be relied upon for service availability. If the depth of recursion can be controlled by an attacker, always sanitize the input or impose a limit by other means to restrict the depth, instead of counting on the JS runtime to impose a limit or recover from it with a catchable error.
 
-**Users running React RSC, Next.js, or any other framework using `AsyncLocalStorage`, as well as any APM tool in production, should upgrade to the patched versions released on January 8th, 2026.**
+**Users running React RSC, Next.js, or any other framework using `AsyncLocalStorage`, as well as any APM tool in production, should upgrade to the patched versions released on January 13th, 2026.**
 
 ## Acknowledgments