Junglewise Threat Intelligence

CVE-2025-59465: Node.js HTTP/2 remote denial of service via malformed HEADERS frame

CVE-2025-59465 · Severity: high · CVSS 7.5 · Published 2026-01-20

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Executive brief

Node.js is a popular environment used to run web servers and network applications. A flaw in how it handles specific types of encrypted web traffic (HTTP/2) allows a remote attacker to crash the server by sending a specially crafted request. This results in a denial of service, making the application unavailable to legitimate users.

Technical details

A vulnerability exists in the Node.js HTTP/2 implementation where processing a malformed HEADERS frame containing oversized or invalid HPACK data triggers an ECONNRESET error within the TLSSocket. If the application does not have an explicit error handler attached to the secure socket (e.g., via the 'secureConnection' event), this unhandled exception causes the entire Node.js process to terminate. This is reachable over the network without authentication. The issue has been addressed in Node.js security releases for the 20.x, 22.x, 24.x, and 25.x branches.

Affected products

  • Node.js Node.js 20.x, 22.x, 24.x, 25.x
  • Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-01-13: patched: Node.js security releases available for 20.x, 22.x, 24.x, and 25.x
  • 2026-01-20: disclosed: Public disclosure of CVE-2025-59465
  • 2026-02-03: advisory: Red Hat issued security advisory RHSA-2026:1842

References

Related threats