A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-01-20 21:16
Updated : 2026-07-15 02:17
NVD link : CVE-2025-59465
Mitre link : CVE-2025-59465
CVE.ORG link : CVE-2025-59465
JSON object : View
Products Affected
nodejs
- node.js