Vulnerability · Published Jan 20, 2026 · Assigned by hackerone

CVE-2025-59465

High 7.5

In plain English

A high-severity uncontrolled resource consumption in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)4.0%top 9.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs	1:24.13.0-0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:8	nodejs	1:22.22.0-1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:9	nodejs	1:22.22.0-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:9	nodejs	1:20.20.0-1.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:9	nodejs	1:24.13.0-1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:8	nodejs-devel	1:22.22.0-1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:8	nodejs-devel	1:24.13.0-0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:9	nodejs-devel	1:24.13.0-1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:9	nodejs-devel	1:20.20.0-1.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:9	nodejs-devel	1:22.22.0-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:10	nodejs-docs	1:22.22.0-3.el10_1	ALSA-2026:1843
AlmaLinux:8	nodejs-docs	1:24.13.0-0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:8	nodejs-docs	1:22.22.0-1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:9	nodejs-docs	1:20.20.0-1.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:9	nodejs-docs	1:22.22.0-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:9	nodejs-docs	1:24.13.0-1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:8	nodejs-full-i18n	1:22.22.0-1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:8	nodejs-full-i18n	1:24.13.0-0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:9	nodejs-full-i18n	1:20.20.0-1.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:9	nodejs-full-i18n	1:22.22.0-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:9	nodejs-full-i18n	1:24.13.0-1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:8	nodejs-libs	1:24.13.0-0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:8	nodejs-libs	1:22.22.0-1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:9	nodejs-libs	1:24.13.0-1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:9	nodejs-libs	1:22.22.0-1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+3982+85c136aa	ALSA-2026:2422
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+4006+3c416519	ALSA-2026:2421
AlmaLinux:8	nodejs-nodemon	3.0.3-1.module_el8.10.0+4061+f8ceeab9	ALSA-2026:2420
AlmaLinux:9	nodejs-nodemon	3.0.1-1.module_el9.6.0+172+f0ba00ec	ALSA-2026:2782
AlmaLinux:9	nodejs-nodemon	3.0.3-3.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:9	nodejs-nodemon	3.0.1-1.module_el9.5.0+125+8dc38870	ALSA-2026:2783
AlmaLinux:8	nodejs-packaging	2021.06-5.module_el8.10.0+4085+6f807d30	ALSA-2026:2421
AlmaLinux:8	nodejs-packaging	2021.06-5.module_el8.10.0+4084+7c0af990	ALSA-2026:2422
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:2420
AlmaLinux:9	nodejs-packaging	2021.06-5.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:9	nodejs-packaging	2021.06-5.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:2420
AlmaLinux:8	nodejs-packaging-bundler	2021.06-5.module_el8.10.0+4084+7c0af990	ALSA-2026:2422
AlmaLinux:8	nodejs-packaging-bundler	2021.06-5.module_el8.10.0+4085+6f807d30	ALSA-2026:2421
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+198+8bf605ba	ALSA-2026:2781
AlmaLinux:9	nodejs-packaging-bundler	2021.06-5.module_el9.7.0+196+ac40ca3b	ALSA-2026:2782
AlmaLinux:9	nodejs-packaging-bundler	2021.06-5.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:10	nodejs24-docs	1:24.13.0-1.el10_1	ALSA-2026:1842
AlmaLinux:10	nodejs24-npm	1:11.6.2-1.24.13.0.1.el10_1	ALSA-2026:1842
AlmaLinux:8	npm	1:11.6.2-1.24.13.0.0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:8	npm	1:10.9.4-1.22.22.0.1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:9	npm	1:10.9.4-1.22.22.0.1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:9	npm	1:10.8.2-1.20.20.0.1.module_el9.7.0+207+84573810	ALSA-2026:2783
AlmaLinux:9	npm	1:11.6.2-1.24.13.0.1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
AlmaLinux:8	v8-12.4-devel	3:12.4.254.21-1.22.22.0.1.module_el8.10.0+4112+db1af44b	ALSA-2026:2421
AlmaLinux:9	v8-12.4-devel	3:12.4.254.21-1.22.22.0.1.module_el9.7.0+208+fb06c0ab	ALSA-2026:2782
AlmaLinux:8	v8-13.6-devel	3:13.6.233.17-1.24.13.0.0.module_el8.10.0+4113+bc863bc2	ALSA-2026:2420
AlmaLinux:9	v8-13.6-devel	3:13.6.233.17-1.24.13.0.1.module_el9.7.0+209+ecf6523e	ALSA-2026:2781
Alpine:v3.21	nodejs	22.22.2-r0	ALPINE-CVE-2025-59465
Alpine:v3.22	nodejs	22.22.0-r0	ALPINE-CVE-2025-59465
Debian:12	nodejs	18.20.4+dfsg-1~deb12u2	DEBIAN-CVE-2025-59465
Debian:13	nodejs	20.19.2+dfsg-1+deb13u1	DSA-6166-1
Debian:13	nodejs	20.19.2+dfsg-1+deb13u1	DEBIAN-CVE-2025-59465
Debian:14	nodejs	22.22.0+dfsg+~cs22.19.6-1	DEBIAN-CVE-2025-59465
Rocky Linux:8	nodejs	1:22.22.0-1.module+el8.10.0+40078+280dc7ce	RLSA-2026:2421
Rocky Linux:8	nodejs	1:24.13.0-0.module+el8.10.0+40079+1d83e08b	RLSA-2026:2420
Rocky Linux:8	nodejs	1:20.20.0-1.module+el8.10.0+40077+29236b21	RLSA-2026:2422
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:2422
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:2422
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:2422
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:2422
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:2421
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:2421
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:2421
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:2421
Rocky Linux:8	nodejs-nodemon	0:3.0.3-1.module+el8.10.0+2084+ab509703	RLSA-2026:2420
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:2782
Rocky Linux:9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2	RLSA-2026:2781
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:2782
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:2782
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:2783
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:2783
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:2783
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:2420
Rocky Linux:9	nodejs-packaging	0:2021.06-5.module+el9.7.0+40051+f2ef3f49	RLSA-2026:2783
Rocky Linux:9	nodejs-packaging	0:2021.06-5.module+el9.7.0+40051+f2ef3f49	RLSA-2026:2782
Rocky Linux:9	nodejs-packaging	0:2021.06-5.module+el9.7.0+40050+22a42328	RLSA-2026:2783
Rocky Linux:9	nodejs-packaging	0:2021.06-5.module+el9.7.0+40050+22a42328	RLSA-2026:2782
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:2781
Rocky Linux:10	nodejs22	1:22.22.0-3.el10_1	RLSA-2026:1843
Rocky Linux:10	nodejs24	1:24.13.0-1.el10_1	RLSA-2026:1842
Ubuntu:24.04:LTS	nodejs	no fix listed	UBUNTU-CVE-2025-59465
Ubuntu:25.10	nodejs	no fix listed	UBUNTU-CVE-2025-59465
Ubuntu:26.04:LTS	nodejs	no fix listed	UBUNTU-CVE-2025-59465

Affected products (as reported)

Vendor	Product	Versions
nodejs	node	20.19.6 – through 20.19.622.21.1 – through 22.21.124.12.0 – through 24.12.025.2.1 – through 25.2.14.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.

Weakness: CWE-400, CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
https://access.redhat.com/security/cve/CVE-2025-59465 vdb-entry, x_refsource_REDHAT
RHBZ#2431349 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59465.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:2899 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:1843 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:1842 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2422 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2421 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2420 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2768 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2767 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2864 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2783 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2782 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2781 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7386 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7387 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6402 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6431 vendor-advisory, x_refsource_REDHAT