Description
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
Published: 2026-01-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6166-1 nodejs security update
Debian DSA Debian DSA DSA-6272-1 nodejs security update
History

Fri, 30 Jan 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nodejs node.js
CPEs cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Vendors & Products Nodejs node.js

Wed, 21 Jan 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Jan 2026 12:15:00 +0000

Type Values Removed Values Added
Title nodejs: Nodejs denial of service
Weaknesses CWE-248
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Wed, 21 Jan 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Nodejs
Nodejs nodejs
Vendors & Products Nodejs
Nodejs nodejs

Tue, 20 Jan 2026 20:45:00 +0000

Type Values Removed Values Added
Description A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nodejs Node.js Nodejs
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-01-21T20:11:28.986Z

Reserved: 2025-09-16T15:00:07.875Z

Link: CVE-2025-59465

cve-icon Vulnrichment

Updated: 2026-01-21T20:11:10.607Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T21:16:04.010

Modified: 2026-01-30T20:25:39.890

Link: CVE-2025-59465

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-20T20:41:55Z

Links: CVE-2025-59465 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-01-21T11:18:38Z

Weaknesses