CVE-2025-59465
published 2026-01-20CVE-2025-59465: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.78%
88.8th percentile
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.0+dfsg+~cs22.19.6-1 (forky) | nodejs 22.22.0+dfsg+~cs22.19.6-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | 20.19.6 – 20.19.6 | — |
| nodejs | node | 22.21.1 – 22.21.1 | — |
| nodejs | node | 24.12.0 – 24.12.0 | — |
| nodejs | node | 25.2.1 – 25.2.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 20.0.0 < 20.20.0 | 20.20.0 |
| nodejs | node.js | >= 22.0.0 < 22.22.0 | 22.22.0 |
| nodejs | node.js | >= 24.0.0 < 24.13.0 | 24.13.0 |
| nodejs | node.js | >= 25.0.0 < 25.3.0 | 25.3.0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs: Nodejs denial of service
vendor_redhat·2026-01-20·CVSS 7.5
CVE-2025-59465 [HIGH] CWE-248 nodejs: Nodejs denial of service
nodejs: Nodejs denial of service
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
A denial of service flaw has been discovered in NodeJS. A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote
Debian
CVE-2025-59465: nodejs - A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can caus...
vendor_debian·2025·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465: nodejs - A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can caus...
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.0+dfsg+~cs22.19.6-1)
sid: resolved (fixed in 22.22.0+dfsg+~cs22.19.6-1)
trixie: resolved (fixed in 20.19.2+dfsg-1+deb13u1)
OSV
CVE-2025-59465: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
osv·2026-01-20·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
GHSA
GHSA-w2pg-hw7v-f7m9: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
ghsa_unreviewed·2026-01-20
CVE-2025-59465 [HIGH] CWE-400 GHSA-w2pg-hw7v-f7m9: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
OSV
CVE-2025-59465: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
osv·2026-01-20·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-59465 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-59465 :
npm vulnerability analysis and mitigation
HTTP/2 HEADERS
HPACK
TLSSocket
ECONNRESET
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
Source : NVD
## 7.5
Score
Published January 20, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
npm
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 22.8
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
nodejs-devel
nodejs22
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity HIGH Has Fix Added at: Ja
Bugzilla
CVE-2025-59465 nodejs18: Nodejs denial of service [fedora-42]
bugzilla·2026-01-21·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465 nodejs18: Nodejs denial of service [fedora-42]
CVE-2025-59465 nodejs18: Nodejs denial of service [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version'
to a later Fed
Bugzilla
CVE-2025-59465 nodejs: Nodejs denial of service
bugzilla·2026-01-20·CVSS 7.5
CVE-2025-59465 [HIGH] CVE-2025-59465 nodejs: Nodejs denial of service
CVE-2025-59465 nodejs: Nodejs denial of service
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:1843 https://access.redhat.com/errata/RHSA-2026:1843
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:1842 h
https://nodejs.org/en/blog/vulnerability/december-2025-security-releaseshttps://access.redhat.com/errata/RHSA-2026:1842https://access.redhat.com/errata/RHSA-2026:1843https://access.redhat.com/errata/RHSA-2026:2420https://access.redhat.com/errata/RHSA-2026:2421https://access.redhat.com/errata/RHSA-2026:2422https://access.redhat.com/errata/RHSA-2026:2767https://access.redhat.com/errata/RHSA-2026:2768https://access.redhat.com/errata/RHSA-2026:2781https://access.redhat.com/errata/RHSA-2026:2782https://access.redhat.com/errata/RHSA-2026:2783https://access.redhat.com/errata/RHSA-2026:2864https://access.redhat.com/errata/RHSA-2026:2899https://access.redhat.com/errata/RHSA-2026:6402https://access.redhat.com/errata/RHSA-2026:6431https://access.redhat.com/errata/RHSA-2026:7386https://access.redhat.com/errata/RHSA-2026:7387https://access.redhat.com/security/cve/CVE-2025-59465https://bugzilla.redhat.com/show_bug.cgi?id=2431349https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59465.json
2026-01-20
Published