CVE-2025-59465
Node.js: malformed HTTP/2 HEADERS frame crashes the process
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
>=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0
Upstream Fix
20.20.0; 22.22.0; 24.13.0; 25.3.0
Published
January 20, 2026
OSSeva Coverage
Fixed upstream
Description
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data triggers an unhandled TLSSocket ECONNRESET error that crashes the process instead of closing the connection, a remote denial of service for applications without explicit error handlers on secure sockets. Rated High by Node.js. Fixed in 20.20.0, 22.22.0, 24.13.0 and 25.3.0.
Is your Node.js deployment affected?
If you're running >=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js >=20.0.0 <20.20.0; >=22.0.0 <22.22.0; >=24.0.0 <24.13.0; >=25.0.0 <25.3.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?