A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
References
Configurations
Configuration 1 (hide)
|
History
30 Jun 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-248 |
17 Jun 2026, 09:46
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
30 Jan 2026, 20:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | |
| First Time |
Nodejs node.js
Nodejs |
|
| References | () https://nodejs.org/en/blog/vulnerability/december-2025-security-releases - Release Notes, Vendor Advisory |
21 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-07-15 02:17
NVD link : CVE-2025-59465
Mitre link : CVE-2025-59465
CVE.ORG link : CVE-2025-59465
JSON object : View
Products Affected
nodejs
- node.js