CVE-2025-59465: NodeJS Security leases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others)
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) })
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59465?
CVE-2025-59465 has a high severity rating due to the potential to crash Node.js applications.
How do I fix CVE-2025-59465?
To fix CVE-2025-59465, update Node.js to the latest version where the vulnerability has been addressed.
What impact does CVE-2025-59465 have on applications?
CVE-2025-59465 can lead to process crashes in applications that handle malformed HTTP/2 HEADERS frames.
Is CVE-2025-59465 specific to certain Node.js versions?
Yes, CVE-2025-59465 affects various versions of Node.js that do not implement fixes for this vulnerability.
What is the cause of the vulnerability in CVE-2025-59465?
CVE-2025-59465 is caused by oversized and invalid HPACK data leading to an unhandled TLSSocket error.