Skip to content

Commit 9b46208

Browse files
mcollinajoyeecheung
andcommitted
Update apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md
Co-authored-by: Joyee Cheung <[email protected]> Signed-off-by: Matteo Collina <[email protected]>
1 parent e095ef6 commit 9b46208

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

apps/site/pages/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ The irony is notable: the tools you install to monitor and debug crashes can mak
327327
Although it is a bug fix for an unspecified behavior, we chose to include it in the security release because of its widespread impact on the ecosystem.
328328
React Server Components, Next.js, and virtually every APM tool are affected. The fix improves developer experience and makes error handling more predictable.
329329
330-
However, it's important to note that we were fortunate to be able to fix this particular case. There's no guarantee that similar edge cases involving stack overflow and `async_hooks` can always be addressed. **For mission-critical paths that must defend against infinite recursion or stack overflow from recursion whose depth can be controlled by an attacker, always sanitize the input or impose a limit on the depth of recursion by other means**. The runtime cannot guarantee reliable recovery from stack space exhaustion with a catchable error.
330+
However, it's important to note that we were fortunate to be able to fix this particular case. There's no guarantee that similar edge cases involving stack overflow and `async_hooks` can always be addressed. **For mission-critical paths that must defend against infinite recursion or stack overflow from recursion whose depth can be controlled by an attacker, always sanitize the input or impose a limit on the depth of recursion by other means**.
331331
332332
It's worth noting that large array allocations can suffer from similar issues, like the recent [`qs`](https://github.com/ljharb/qs) vulnerability [CVE-2025-15284](https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p) showed. It's paramount that developers validate and constrain resource usage that could be controlled by an attacker. The runtime cannot always recover reliably from resource exhaustion after-the-fact.
333333

0 commit comments

Comments
 (0)