Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-59465

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely clos

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nodejs node

Default version status: unaffected

  • 20.19.6 to ≤ 20.19.6affected
  • 22.21.1 to ≤ 22.21.1affected
  • 24.12.0 to ≤ 24.12.0affected
  • 25.2.1 to ≤ 25.2.1affected
  • 4.0 to < 4.*affected
  • 5.0 to < 5.*affected
  • 6.0 to < 6.*affected
  • 7.0 to < 7.*affected
  • 8.0 to < 8.*affected
  • 9.0 to < 9.*affected
  • 10.0 to < 10.*affected
  • 11.0 to < 11.*affected
  • 12.0 to < 12.*affected
  • 13.0 to < 13.*affected
  • 14.0 to < 14.*affected
  • 15.0 to < 15.*affected
  • 16.0 to < 16.*affected
  • 17.0 to < 17.*affected
  • 18.0 to < 18.*affected

References