CVE-2025-59465: 
npm vulnerability analysis and mitigation

CVE-2025-59465 is a denial-of-service vulnerability in Node.js's HTTP/2 server implementation, titled "Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame." A remote, unauthenticated attacker can send a malformed HTTP/2 HEADERS frame containing oversized, invalid HPACK data, causing the Node.js process to crash via an unhandled TLSSocket error (ECONNRESET). The vulnerability affects Node.js versions 20.x before 20.20.0, 22.x before 22.22.0, 24.x before 24.13.0, and 25.x before 25.3.0, and was disclosed on January 20, 2026. It carries a CVSS v3.0 base score of 7.5 (High), assigned by HackerOne (Node.js Advisory, Red Hat).

The root cause is an uncaught exception (CWE-248) combined with uncontrolled resource consumption (CWE-400) in Node.js's HTTP/2 handling layer. When a malformed HEADERS frame with oversized, invalid HPACK data is received over a TLS connection, the internal HPACK decompression triggers an ECONNRESET error on the TLSSocket. Because Node.js does not attach a default error handler to the socket in this code path, the error propagates as an unhandled exception and crashes the entire process rather than safely closing the connection. The vulnerability primarily affects applications that omit explicit error listeners on secure sockets (e.g., via the secureConnection event), and is exploitable over the network with no authentication or user interaction required (Node.js Advisory, Red Hat Bugzilla).

Successful exploitation causes the Node.js server process to crash entirely, resulting in complete loss of availability for any application running on the affected instance. Because the crash terminates the process rather than just closing the offending connection, all active connections and in-flight requests are dropped simultaneously. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service issue — but repeated exploitation can keep a service continuously unavailable (Node.js Advisory, Red Hat).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Red Hat). The vulnerability is unauthenticated and network-accessible with low attack complexity, making it straightforward to trigger once the attack vector is understood. The EPSS score is approximately 0.047%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Node.js HTTPS/HTTP2 servers using tools like Shodan or Censys, targeting services running Node.js versions 20.x < 20.20.0, 22.x < 22.22.0, 24.x < 24.13.0, or 25.x < 25.3.0.
2. Establish TLS connection: Initiate a TLS connection to the target server to reach the HTTP/2 layer, as the vulnerability is triggered over secure (TLS) sockets.
3. Craft malformed HEADERS frame: Construct a malformed HTTP/2 HEADERS frame containing oversized, invalid HPACK-encoded header data that exceeds expected bounds.
4. Send the malicious frame: Transmit the crafted frame to the server. The HPACK decompression failure triggers an ECONNRESET error on the TLSSocket.
5. Trigger process crash: Because the application lacks an explicit error handler on the secure socket, the unhandled error propagates and crashes the entire Node.js process, taking down the service (Node.js Advisory).

• Logs: Sudden Node.js process termination with no graceful shutdown message; absence of expected request logs followed by service restart entries; potential ECONNRESET or unhandled error stack traces in application logs immediately before crash.
• Network: Unusual or malformed HTTP/2 HEADERS frames from a single source IP targeting the HTTPS port; repeated TLS connection attempts from the same IP followed by server restarts.
• Process: Unexpected Node.js process exits (exit code indicating uncaught exception); process supervisor (e.g., PM2, systemd) logs showing repeated restarts of the Node.js service in a short time window.

The primary remediation is to upgrade Node.js to a patched version: 20.20.0, 22.22.0, 24.13.0, or 25.3.0 (or later) (Node.js Advisory). As a workaround for applications that cannot be immediately upgraded, attach explicit error handlers to secure sockets via the secureConnection event to prevent unhandled errors from crashing the process:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.error(err);
  });
});

Red Hat has issued multiple errata (RHSA-2026:1842, RHSA-2026:1843, RHSA-2026:2420–2422, RHSA-2026:2767–2768, RHSA-2026:2781–2783, RHSA-2026:2864, RHSA-2026:2899) for RHEL 8, 9, and 10 (Red Hat Bugzilla). IBM has also released patches for affected products including Instana OnPrem and Cloud Pak for Business Automation (IBM Advisory).

The Node.js security release was covered by multiple security news outlets including The Hacker News, GBHackers, and SecurityOnline, with some headlines describing it as affecting "virtually every Node.js app" due to its broad version coverage (The Hacker News). Endor Labs published a technical digest covering all eight vulnerabilities fixed in the release (Endor Labs). The German BSI (Federal Office for Information Security) also issued an update notification for the critical Node.js vulnerabilities. Community discussion on OSS-Sec and LinkedIn noted the broad impact across all active Node.js release lines.