CVE-2025-59465
📋 TL;DR
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash due to an unhandled TLSSocket ECONNRESET error, enabling remote denial of service. This affects Node.js applications that don't attach explicit error handlers to secure sockets. The vulnerability allows attackers to crash Node.js processes remotely.
💻 Affected Systems
- Node.js
📦 What is this software?
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through repeated crashes, potentially affecting all Node.js applications on the affected server.
Likely Case
Intermittent service disruptions and application crashes requiring manual restarts.
If Mitigated
Graceful connection closure with logged errors but no service interruption.
🎯 Exploit Status
Attack requires sending malformed HTTP/2 frames to vulnerable Node.js servers. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Node.js December 2025 security releases
Vendor Advisory: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
Restart Required: Yes
Instructions:
1. Check current Node.js version. 2. Update to the latest patched version from December 2025 security releases. 3. Restart all Node.js applications and services.
🔧 Temporary Workarounds
Add error handlers to secure sockets
allImplement explicit error handlers for secureConnection events as shown in the CVE description
// Add to your Node.js server code:
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log('Socket error:', err);
socket.destroy();
});
});
🧯 If You Can't Patch
- Implement network-level protections like WAF rules to block malformed HTTP/2 traffic
- Use load balancers with HTTP/2 protocol validation and connection limiting
🔍 How to Verify
Check if Vulnerable:
Check if your Node.js application lacks error handlers for secureConnection events and if using HTTP/2Check Version:
node --versionVerify Fix Applied:
Verify Node.js version is from December 2025 security releases or later, and test with malformed HTTP/2 traffic📡 Detection & Monitoring
Log Indicators:
- Multiple ECONNRESET errors on TLSSocket
- Unexpected Node.js process crashes
- HTTP/2 connection failures
Network Indicators:
- Malformed HTTP/2 HEADERS frames with oversized HPACK data
- Repeated connection attempts to Node.js ports
SIEM Query:
source="nodejs" AND ("ECONNRESET" OR "TLSSocket error" OR "process crashed")