CVE-2025-59465

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59465
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59465.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-59465
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (22)
CLSA (3)
DEBIAN (1)
MGASA (1)
MINI (7)
OESA (6)
openSUSE (4)
RHSA (16)
RLSA (8)
SUSE (7)
UBUNTU (1)
Related
ALSA (8)
openSUSE (4)
SUSE (7)
Published
2026-01-20T20:41:55Z
Modified
2026-09-18T18:11:38Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
Database specific 
{
    "cna_assigner":  "hackerone",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59465.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "20.19.6"
                },
                {
                    "last_affected":  "20.19.6"
                },
                {
                    "introduced":  "22.21.1"
                },
                {
                    "last_affected":  "22.21.1"
                },
                {
                    "introduced":  "24.12.0"
                },
                {
                    "last_affected":  "24.12.0"
                },
                {
                    "introduced":  "25.2.1"
                },
                {
                    "last_affected":  "25.2.1"
                },
                {
                    "introduced":  "4.0"
                },
                {
                    "fixed":  "4.*"
                },
                {
                    "introduced":  "5.0"
                },
                {
                    "fixed":  "5.*"
                },
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.*"
                },
                {
                    "introduced":  "7.0"
                },
                {
                    "fixed":  "7.*"
                },
                {
                    "introduced":  "8.0"
                },
                {
                    "fixed":  "8.*"
                },
                {
                    "introduced":  "9.0"
                },
                {
                    "fixed":  "9.*"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "fixed":  "10.*"
                },
                {
                    "introduced":  "11.0"
                },
                {
                    "fixed":  "11.*"
                },
                {
                    "introduced":  "12.0"
                },
                {
                    "fixed":  "12.*"
                },
                {
                    "introduced":  "13.0"
                },
                {
                    "fixed":  "13.*"
                },
                {
                    "introduced":  "14.0"
                },
                {
                    "fixed":  "14.*"
                },
                {
                    "introduced":  "15.0"
                },
                {
                    "fixed":  "15.*"
                },
                {
                    "introduced":  "16.0"
                },
                {
                    "fixed":  "16.*"
                },
                {
                    "introduced":  "17.0"
                },
                {
                    "fixed":  "17.*"
                },
                {
                    "introduced":  "18.0"
                },
                {
                    "fixed":  "18.*"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
e7618fb5a5fc25d76b6474e2a6607f04fd6f10e0
Fixed
1f7186e1e01d279022cab6acdecb119e472bb409
Introduced
12fb157f79da8c094a54bc99370994941c28c235
Fixed
6add85e4c46b8be383c8b637102d6b6fd206adce
Introduced
c5349f43cd66d2aa02d86414c9ed426f71d3ae48
Fixed
def0bdf8abee441cfcbf793a8dc24a6f3b899573
Introduced
0b3a10d4c8ba5e15429287e725d22615be896e95
Fixed
00d6cd83927d6d5c8fe9d0cdd101daa6df4b1a15
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "20.0.0"
        },
        {
            "fixed":  "20.20.0"
        },
        {
            "introduced":  "22.0.0"
        },
        {
            "fixed":  "22.22.0"
        },
        {
            "introduced":  "24.0.0"
        },
        {
            "fixed":  "24.13.0"
        },
        {
            "introduced":  "25.0.0"
        },
        {
            "fixed":  "25.3.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v20.*
v20.0.0
v20.1.0
v20.10.0
v20.11.0
v20.11.1
v20.12.0
v20.12.1
v20.12.2
v20.13.0
v20.13.1
v20.14.0
v20.15.0
v20.15.1
v20.16.0
v20.17.0
v20.18.0
v20.18.1
v20.18.2
v20.18.3
v20.19.0
v20.19.1
v20.19.2
v20.19.3
v20.19.4
v20.19.5
v20.19.6
v20.2.0
v20.3.0
v20.3.1
v20.4.0
v20.5.0
v20.5.1
v20.6.0
v20.6.1
v20.7.0
v20.8.0
v20.8.1
v20.9.0
v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0
v25.*
v25.0.0
v25.1.0
v25.2.0
v25.2.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59465.json"