Mitigation for Node.js denial-of-service vulnerability affecting Datadog APM

Datadog | The Monitor blog

Introducing our open source AI-native SAST Instrument and monitor Boomi integration flows with OpenTelemetry and Datadog Not all index scans are equal: How we cut query latency by over 99% Platform engineering metrics: What to measure and what to ignore Integrate Recorded Future threat intelligence with Datadog Cloud SIEM CI/CD security: threat modeling using a MITRE-style threat matrix CI/CD security: How to secure your GitHub ecosystem Ingress NGINX is EOL: A practical guide for migrating to Kubernetes Gateway API Operating agentic AI with Amazon Bedrock AgentCore and Datadog LLM Observability: Lessons from NTT DATA Introducing the Datadog Code Security MCP Capture and analyze custom heatmaps in Session Replay Understand session replays faster with AI summaries and smart chapters Monitor ClickHouse query performance with Datadog Database Monitoring How we designed empathetic alert sounds for on-call engineers Search and act across Datadog to resolve issues faster with Bits Assistant Measure the business impact of every product change with Datadog Experiments Analyzing round trip query latency Configuring JavaScript caches for better performance Introducing Bits AI Dev Agent for Code Security Datadog achieves ISO 42001 certification for responsible AI Monitor Nutanix clusters, hosts, and VMs with Datadog Monitor Juniper Mist in Datadog A new Host Map for modern infrastructure Annotate traces to improve LLM quality with Datadog LLM Observability What’s new in Cloud SIEM: AI-powered investigations, enhanced threat intelligence, and scalable security operations Explore Kubernetes with native OpenTelemetry data Monitor Oracle Fusion Cloud Applications with Datadog Announcing the Datadog Terraform provider v4.0.0 Scaling Kubernetes workloads on custom metrics How to design cloud environments for AI-powered threat analysis Monitor Aruba Central in Datadog How we centralize and remediate risks with Datadog Case Management Accelerate incident response with Datadog and ServiceNow Monitor your application and network load balancer logs Understanding Karpenter architecture for Kubernetes autoscaling Tools for collecting metrics and logs from Karpenter Monitor Karpenter with Datadog What your product data is actually saying Key metrics for monitoring Karpenter Securing Datadog’s platform in the AI age: The role of observability data Four ways engineering teams use the Datadog MCP Server to power AI agents Approaching your observability migration with the right mindset Meet the new Bits AI SRE: Deeper reasoning, twice as fast Key learnings from the 2026 State of DevSecOps study Use plain English to query your multi-cloud infrastructure in Resource Catalog Simplifying troubleshooting across the user journey with Datadog Synthetic Monitoring Protect your OCI resources with Datadog Cloud Security This Month in Datadog - February 2026 Amazon EC2 security: How misconfigured and public AMIs expand your cloud attack surface Enable end-to-end visibility into your Java apps with a single command Measure and improve mobile app startup performance with Datadog RUM Evaluating our AI Guard application to improve quality and control cost Identify untested code across every level of your codebase Make use of guardrail metrics and stop babysitting your releases Monitor Versa Networks SD-WAN performance in Datadog Improve performance and reliability with APM Recommendations Remediate transitive vulnerabilities faster with Datadog Software Composition Analysis Generate audit-ready vulnerability and compliance reports with Datadog Sheets Monitor Fortinet FortiManager performance in Datadog Improve test coverage across codebases with Datadog Code Coverage Move fast, don’t break things: Consistent testing standards at scale Enrich logs with ServiceNow CMDB context before routing to any SIEM or logging tool Monitor Lustre with Datadog Make faster, better product decisions with Datadog Product Analytics Surface and remediate runtime posture issues with Workload Protection Findings Protect agentic AI applications with Datadog AI Guard How to optimize JavaScript code with CSS Trace Google Pub/Sub workloads in Cloud Run with Datadog Detect human names in logs with ML in Sensitive Data Scanner How we cut our NLQ agent debugging time from hours to minutes with LLM Observability Debug PostgreSQL query latency faster with EXPLAIN ANALYZE in Datadog Database Monitoring Datadog acquires Propolis Unify and correlate frontend and backend data with retention filters Scale compliance across global frameworks with Datadog Cloud Security Monitor Arista VeloCloud SD-WAN performance with Datadog Building reliable dashboard agents with Datadog LLM Observability Simplify log collection and aggregation for MSSPs with Datadog Observability Pipelines Automate flaky test fixes with the Bits AI Dev Agent and Test Optimization How we built an AI SRE agent that investigates like a team of engineers Datadog integrations 2025 recap: Observability for AI, security, and hybrid cloud Design effective executive dashboards with Datadog Implement dbt data quality checks with dbt-expectations Bring faster visibility into AWS Lambda functions with remote instrumentation Troubleshoot faster with the GitLab Source Code integration in Datadog How Cambia Health Solutions saved $30,000 monthly with Cloud Cost Management and the Datadog Resource Catalog Normalize any logs for Cloud SIEM with Datadog's OCSF processor Optimizing Datadog at scale: Cost-efficient observability at Zendesk Detect, diagnose, and resolve network issues easily with CNM Network Health Securing customer logins with breach intelligence Connect engineering errors to user impact in early-stage products Cilium configuration for Kubernetes operations at scale Designing feedback loops for progressive delivery Ship features faster and safer with Datadog Feature Flags Choosing the right OpenTelemetry Collector distribution Route your monitor alerts with Datadog monitor notification rules Automate Cloud SIEM investigations with Bits AI Security Analyst Cloud threat detection: How to identify risky activity across control and data planes Collecting Kafka performance metrics Monitoring Kafka with Datadog Monitoring Kafka performance metrics

2026-01-14 · via Datadog | The Monitor blog

On January 13, 2026, Node.js released information about a denial-of-service (DoS) vulnerability that affects applications that use async_hooks or AsyncLocalStorage. This vulnerability is tracked as CVE-2025-59466 and can cause Node.js processes to exit unexpectedly when certain stack overflow conditions occur while async_hooks are enabled.

Because Datadog APM’s Node.js dd-trace-js tracer uses AsyncLocalStorage to trace requests, this issue is relevant to APM customers who use affected Node.js versions (8.x through 23.x). This vulnerability is not specific to Datadog APM’s Node.js dd-trace-js tracer, and we have validated the tracer against patched Node.js versions.

This post will walk you through:

A summary of the vulnerability
How to use Datadog Cloud Security to identify vulnerable Node.js packages in your environment
How to remediate the vulnerability

Summary of the vulnerability

In affected Node.js versions, if a stack overflow occurs in user code while async_hooks are active, Node.js may immediately terminate the process instead of throwing a catchable RangeError. This behavior bypasses standard error handlers, making the failure unrecoverable and enabling DoS attacks.

Because AsyncLocalStorage is built on top of async_hooks, this issue can surface in applications and frameworks that rely on request context, including React Server Components (React 18 or later), Next.js, and application performance monitoring tooling. For customers running vulnerable Node.js versions, applications may be susceptible to process crashes if unsanitized user input can trigger excessive recursion.

Detect vulnerable Node.js packages with Datadog Cloud Security

Datadog Cloud Security helps you understand and manage vulnerability exposure by continuously scanning your workloads. Using the following search query, you can review detected Node.js packages across your environment, including versions within the affected 8.x through 23.x range:

(cve:CVE-2025-59466 OR package_name:nodejs)

Because this vulnerability depends on runtime behavior, only workloads actively executing an affected Node.js version are susceptible. Datadog Cloud Security enables you to prioritize running workloads while maintaining visibility into unused Node.js versions that may require future upgrades. Each finding includes additional information about the vulnerability and the recommended Node.js version to upgrade to.

We recommend upgrading to one of the following patched Node.js versions released on January 13, 2026:

Node.js 25.3.0 (Current)
Node.js 24.13.0 (LTS)
Node.js 22.22.0 (LTS)
Node.js 20.20.0 (LTS)

For details about the vulnerability and remediation steps, see Datadog’s Security Research Feed.

Closing

We will continue to monitor advisories closely and validate Datadog’s tracer compatibility with patched releases. Customers who have questions about their specific configuration or upgrade path are encouraged to contact Datadog Support.

Acknowledgments

Thank you to Kennedy Toomey, Ryan Simon, and Eslam Salem, all of whom contributed to this post.

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Datadog | The Monitor blog

Summary of the vulnerability

Detect vulnerable Node.js packages with Datadog Cloud Security

Closing

Acknowledgments