CVE-2025-59465

Published Jan 20, 2026

Last updated a month ago

CVSS high 7.5

Overview

Description: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
Source: support@hackerone.com
NVD status: Analyzed
Products: node.js

Risk scores

CVSS 3.0

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-400

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "A78B4AE9-C1B4-4DD0-9EDF-A3A60431B6DA",
            "versionEndExcluding": "20.20.0",
            "versionStartIncluding": "20.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "132A7510-B3E9-4F85-9B61-A834B12DD7D7",
            "versionEndExcluding": "22.22.0",
            "versionStartIncluding": "22.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "A83233BD-D901-4A1A-A3AF-0DC3E76CD2C0",
            "versionEndExcluding": "24.13.0",
            "versionStartIncluding": "24.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "970EF154-D905-4FDA-85CB-C3AB08BEFAEC",
            "versionEndExcluding": "25.3.0",
            "versionStartIncluding": "25.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.0

Weaknesses

Social media

Configurations

Related CVEs

References