UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59465

Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame

Severity
High 7.5
Published
13 Jan 2026
Last changed
15 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.20.0, 22.22.0, 24.13.0, 25.3.0
Sources
NVD, nodejs

Description

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ```…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.20.0
  • From 22.0.0 before 22.22.0
  • From 24.0.0 before 24.13.0
  • From 25.0.0 before 25.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59465
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59465
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases