CVE-2025-59465
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/01/2026
Last modified:
20/01/2026
Description
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:<br />
```<br />
server.on(&#39;secureConnection&#39;, socket => {<br />
socket.on(&#39;error&#39;, err => {<br />
console.log(err)<br />
})<br />
})<br />
```
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH