Cloudanix VulnDB

CVE-2025-59465

High · 7.5

CVSS

7.5

EPSS

4.0%

Published

Jan 20, 2026

CISA due date

—

The record

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```

Affected packages

Ecosystem Package Introduced Fixed
Bitnami node 0 20.20.0
Bitnami node-min 0 20.20.0
Chainguard nodejs-16 0 16.20.2-r16
Chainguard nodejs-20 0 20.20.0-r0
Chainguard nodejs-20-doc 0 20.20.0-r0
Chainguard nodejs-22 0 22.22.0-r0
Chainguard nodejs-22-doc 0 22.22.0-r0
Chainguard nodejs-24 0 24.13.0-r0
Chainguard nodejs-24-doc 0 24.13.0-r0
Chainguard nodejs-25 0 25.3.0-r0
Mageia:9 nodejs 0 22.22.0-1.mga9
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server 15 SP6-LTSS nodejs22 0 22.22.0-150600.13.12.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs20 0 20.20.0-150600.3.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 nodejs22 0 22.22.0-150600.13.12.1
Wolfi nodejs-16 0 16.20.2-r16
Wolfi nodejs-20 0 20.20.0-r0
Wolfi nodejs-20-doc 0 20.20.0-r0
Wolfi nodejs-22 0 22.22.0-r0
Wolfi nodejs-22-doc 0 22.22.0-r0
Wolfi nodejs-24 0 24.13.0-r0
Wolfi nodejs-24-doc 0 24.13.0-r0
Wolfi nodejs-25 0 25.3.0-r0
openSUSE:Leap 15.6 nodejs20 0 20.20.0-150600.3.15.1
openSUSE:Leap 15.6 nodejs22 0 22.22.0-150600.13.12.1
openSUSE:Leap 16.0 nodejs22 0 22.22.0-160000.1.1
openSUSE:Tumbleweed nodejs22 0 22.22.0-1.1
openSUSE:Tumbleweed nodejs24 0 24.13.0-1.1
openSUSE:Tumbleweed nodejs26 0 26.3.1-1.1

Related vulnerabilities