CVE-2025-59465: Node.js HTTP/2 HPACK DOS Vulnerability

CVE-2025-59465 Overview

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets.

Critical Impact

Remote attackers can crash Node.js servers by sending specially crafted HTTP/2 HEADERS frames, causing complete service disruption without authentication.

Affected Products

• Node.js applications using HTTP/2 with TLS
• Node.js servers without explicit TLSSocket error handlers
• Applications relying on secure HTTP/2 connections

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-59465 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-59465

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and represents a Denial of Service condition in Node.js's HTTP/2 implementation. The flaw occurs when processing malformed HTTP/2 HEADERS frames containing oversized or invalid HPACK-encoded data.

When a Node.js server receives such a malicious frame over a TLS connection, the underlying TLSSocket triggers an ECONNRESET error. If the application has not registered an explicit error handler for the secureConnection event on the socket, this error propagates as an unhandled exception, causing the entire Node.js process to crash.

The vulnerability is particularly dangerous because it can be exploited remotely without any authentication. An attacker simply needs to establish an HTTP/2 connection to the target server and send a crafted HEADERS frame. The attack does not require any special privileges or user interaction, making it trivially exploitable across the network.

Root Cause

The root cause lies in Node.js's failure to gracefully handle malformed HPACK data within HTTP/2 HEADERS frames at the TLS socket level. Instead of catching the error internally and closing the connection safely, the error bubbles up through the socket layer. Applications that follow common coding patterns without attaching explicit error handlers to each secure socket connection are vulnerable to complete process termination.

The issue manifests specifically in applications that do not implement error handling similar to:

server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Establishing an HTTP/2 connection to a vulnerable Node.js server over TLS
2. Crafting an HTTP/2 HEADERS frame with oversized or malformed HPACK data
3. Sending the malicious frame to the server
4. The server processes the frame, triggering the ECONNRESET error on the TLSSocket
5. Without an explicit error handler, the unhandled error crashes the Node.js process

This attack can be repeated to keep the service unavailable, causing sustained denial of service conditions. The simplicity of the attack and its network accessibility make it a significant threat to production Node.js deployments.

Detection Methods for CVE-2025-59465

Indicators of Compromise

• Sudden Node.js process crashes with ECONNRESET errors in TLS socket handling
• Unusual HTTP/2 connection patterns with malformed HEADERS frames in network traffic
• Application logs showing unhandled exceptions originating from TLSSocket events
• Repeated service restarts without corresponding application-level errors

Detection Strategies

• Monitor for ECONNRESET errors specifically associated with HTTP/2 TLS connections
• Implement application-level logging that captures unhandled socket errors before process termination
• Deploy network intrusion detection rules to identify malformed HTTP/2 HEADERS frames with abnormal HPACK data sizes
• Use process monitoring to detect unexpected Node.js crashes and correlate with incoming network connections

Monitoring Recommendations

• Enable verbose logging for HTTP/2 and TLS subsystems in Node.js applications
• Configure process managers (PM2, systemd) to alert on repeated crash-restart cycles
• Implement application performance monitoring (APM) to track TLS socket error rates
• Review network traffic for anomalous HTTP/2 frame patterns, particularly oversized HEADERS frames

How to Mitigate CVE-2025-59465

Immediate Actions Required

• Add explicit error handlers to all secureConnection socket events in HTTP/2 server implementations
• Review and update Node.js to the patched version as specified in the security advisory
• Implement process-level supervision to automatically restart crashed services while patches are deployed
• Consider temporarily disabling HTTP/2 if the application can function with HTTP/1.1

Patch Information

Node.js has released security patches addressing this vulnerability. Organizations should consult the Node.js December 2025 Security Releases for specific patch versions and upgrade instructions. Apply the security update to all affected Node.js installations immediately.

Workarounds

• Implement explicit error handlers on all TLSSocket instances used with HTTP/2 connections
• Deploy a reverse proxy or load balancer that can filter malformed HTTP/2 frames before they reach Node.js
• Use rate limiting on HTTP/2 connections to reduce the impact of repeated crash attempts
• Consider containerization with automatic restart policies to minimize service downtime during attacks

// Workaround: Add explicit error handler to prevent crashes
server.on('secureConnection', socket => {
  socket.on('error', err => {
    // Log the error and close the socket gracefully
    console.error('TLSSocket error:', err.message);
    socket.destroy();
  });
});