Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have come to rely on for service availability, A bug that only reproduces when async_hooks are used would break this attempt, causing Node.js to exit with 7 directly without throwing a catchable error when recursions in user code exhaust the stack space. This makes applications whose recursion depth is controlled by unsanitized input vulnerable to Denial-of-Service attacks.
Tracked as CVE-2025-43400, the security defect is described as an out-of-bounds write issue in the operating system's FontParser component that could lead to a denial-of-service (DoS) condition or memory corruption. "Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory," Apple explains. According to advisories from the Hong Kong CERT and Akaoma Cybersecurity, the vulnerability can be exploited remotely, without privileges, although user interaction is required.
