CVE-2025-59465: Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) })
Other sources
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.0Fixed in 22.22.0Fixed in 24.13.0Fixed in 25.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.13.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.3.0 - Compensating control
Attach an explicit error handler to secure sockets, such as registering socket.on('error', err => { ... }) inside the server's secureConnection handler, to handle TLSSocket ECONNRESET errors.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-59465?
CVE-2025-59465 has a high severity rating due to the potential to crash Node.js applications.
How do I fix CVE-2025-59465?
To fix CVE-2025-59465, update Node.js to the latest version where the vulnerability has been addressed.
What impact does CVE-2025-59465 have on applications?
CVE-2025-59465 can lead to process crashes in applications that handle malformed HTTP/2 HEADERS frames.
Is CVE-2025-59465 specific to certain Node.js versions?
Yes, CVE-2025-59465 affects various versions of Node.js that do not implement fixes for this vulnerability.
What is the cause of the vulnerability in CVE-2025-59465?
CVE-2025-59465 is caused by oversized and invalid HPACK data leading to an unhandled TLSSocket error.