CVE-2025-59465High· 7.5▾ TwilightA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remot…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.8%
3.8% → 4.0%
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
node.js >= 20.0.0, < 20.20.0node.js >= 22.0.0, < 22.22.0node.js >= 24.0.0, < 24.13.0node.js >= 25.0.0, < 25.3.0Upgrade past the affected range:
node.js 25.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-55130Critical· 9.1A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
CVE-2026-85024Medium· 5.9undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit
CVE-2026-85014Medium· 5.9undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake
CVE-2026-84947Low· 3.7undici's dump interceptor reads and discards a response body up to a configurable maximum size
CVE-2026-19534High· 7.5undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested
CVE-2026-21711Medium· 5.3A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running unde…