VDB
BIT-node-min-2025-59465
BIT-node-min-2025-59465
PUBLISHED
CVSS 7.5 HIGH
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node-min | 0, 21.0.0, 23.0.0 |
Timeline
- Jan 26, 2026 CVE Published
- Jul 6, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
- Aug 8, 2026 Distribution Patch
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releases url
- https://nvd.nist.gov/vuln/detail/CVE-2025-59465 url
- https://access.redhat.com/errata/RHSA-2026:1842 url
- https://access.redhat.com/errata/RHSA-2026:1843 url
- https://access.redhat.com/errata/RHSA-2026:2420 url
- https://access.redhat.com/errata/RHSA-2026:2421 url
- https://access.redhat.com/errata/RHSA-2026:2422 url
- https://access.redhat.com/errata/RHSA-2026:2767 url
- https://access.redhat.com/errata/RHSA-2026:2768 url
- https://access.redhat.com/errata/RHSA-2026:2781 url
- https://access.redhat.com/errata/RHSA-2026:2782 url
- https://access.redhat.com/errata/RHSA-2026:2783 url
- https://access.redhat.com/errata/RHSA-2026:2864 url
- https://access.redhat.com/errata/RHSA-2026:2899 url
- https://access.redhat.com/errata/RHSA-2026:6402 url
- https://access.redhat.com/errata/RHSA-2026:6431 url
- https://access.redhat.com/errata/RHSA-2026:7386 url
- https://access.redhat.com/errata/RHSA-2026:7387 url
- https://access.redhat.com/security/cve/CVE-2025-59465 url
- https://bugzilla.redhat.com/show_bug.cgi?id=2431349 url
…and 1 more