Remote Denial of Service Vulnerability in Node.js Application

CVE-2025-59465

What is CVE-2025-59465?

A vulnerability exists in Node.js where a malformed HTTP/2 HEADERS frame containing oversized and invalid HPACK data can lead to a crash. When this occurs, it triggers an unhandled TLSSocket error (ECONNRESET). Instead of gracefully closing the connection, the process fails, potentially causing remote denial of service. This issue predominantly affects applications that do not implement explicit error handlers on secure sockets, which can lead to significant disruptions in service.

References