CVE-2025-59465
Last modified
CVE-2025-59465 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. EPSS estimates a 0.93% chance of exploitation in the next 30 days.
Description
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 20.0.0, < 20.20.0 |
| Nodejs | Node.Js | >= 22.0.0, < 22.22.0 |
| Nodejs | Node.Js | >= 24.0.0, < 24.13.0 |
| Nodejs | Node.Js | >= 25.0.0, < 25.3.0 |
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releasesRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59465?
How severe is CVE-2025-59465?
How do I fix CVE-2025-59465?
Are you affected by CVE-2025-59465?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST