Bug 2431349 (CVE-2025-59465) - CVE-2025-59465 nodejs: Nodejs denial of service
Summary: CVE-2025-59465 nodejs: Nodejs denial of service
Keywords:
Status: NEW
Alias: CVE-2025-59465
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2431480 2431482 2431484 2431487 2431490 2431493 2431496
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-20 21:03 UTC by OSIDB Bzimport
Modified: 2026-01-21 01:14 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-20 21:03:02 UTC
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
```
server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```


Note You need to log in before you can comment on or make changes to this bug.