CVE-2025-59465
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
| Software | From | Fixed in |
|---|---|---|
| nodejs / node.js | 20.0.0 | 20.20.0 |
| nodejs / node.js | 22.0.0 | 22.22.0 |
| nodejs / node.js | 24.0.0 | 24.13.0 |
| nodejs / node.js | 25.0.0 | 25.3.0 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime