CVE-2025-59465

high

Description

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => { socket.on('error', err => { console.log(err); }); }); JavaScriptCopy to clipboard Impact: Thank you, to dantt for reporting this vulnerability and thank you RafaelGSS for fixing it.