CVE-2025-59465: Node.js HTTP/2 server crash on malformed HEADERS frame

High 7.5 EPSS 4.0% Node.js

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data triggers an unhandled TLSSocket ECONNRESET error that crashes the Node.js process instead of closing the connection. Any remote client can take down an HTTP/2 (TLS) server that has no error handler on its secure sockets. Fixed in the January 13, 2026 releases (High, CVSS 7.5); CISA's SSVC marks it automatable, with no known exploitation.

CVE-2025-59465CVE identifier
7.5CVSS 3.1 base score (high)
4.0%EPSS: chance of exploitation in the next 30 days (higher than 90% of CVEs)
2026-01-20published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Node.js and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Node.js never reloads its binary or libraries: restart every long-running node process after updating. systemd: sudo systemctl restart <app>.service. PM2: pm2 update (restarts the PM2 daemon and all apps on the new runtime), then pm2 save; with nvm, reinstall pm2 under the new version first (nvm install --reinstall-packages-from does this). Containers: rebuild the image and recreate the containers / roll out the pods; restarting an old container keeps the old Node.js. Confirm with node -v in the same environment the service uses.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

Node.js 20.x up to 20.19.6
Node.js 22.x up to 22.21.1
Node.js 24.x up to 24.12.0
Node.js 25.x up to 25.2.1

Fixed in:

Node.js 20.20.0
Node.js 22.22.0
Node.js 24.13.0
Node.js 25.3.0

Node.js lines affected: 20.x || 22.x || 24.x || 25.x; fixed in ^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0.

Am I affected?

node -v
dpkg -l nodejs 'libnode*' 2>/dev/null | grep ^ii      # Debian/Ubuntu
rpm -q nodejs nodejs22 nodejs24 2>/dev/null; dnf module list --enabled nodejs   # RHEL
apk info -v nodejs nodejs-current 2>/dev/null          # Alpine
docker run --rm <image> node -v                         # containers
grep -rnE "http2" --include='*.js' --include='*.mjs' --include='*.ts' .   # code that starts an HTTP/2 server

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update
sudo apt install --only-upgrade nodejs
node -v
# Debian ships nodejs 18.x (bookworm) and 20.x (trixie) with backported fixes.
# Running 22/24/26 from NodeSource (deb.nodesource.com)? The same command installs the fixed upstream build.

Ubuntu

# Ubuntu has not published a nodejs fix for this CVE (tracker status needs-triage, 2026-11-03).
# See https://ubuntu.com/security/CVE-2025-59465. Use a fixed upstream build instead:
# If Node.js comes from the NodeSource repo (deb.nodesource.com), the fixed builds are there:
sudo apt update
sudo apt install --only-upgrade nodejs
node -v

RHEL, AlmaLinux, Rocky, Oracle

sudo dnf module list --enabled nodejs        # RHEL 8/9: which stream is enabled
sudo dnf upgrade --refresh 'nodejs*'
node -v
# Stream with no fix (or EOL nodejs:20)? switch to a fixed stream, e.g. nodejs:24 on RHEL 8/9:
sudo dnf module reset -y nodejs && sudo dnf module enable -y nodejs:24 && sudo dnf distro-sync -y 'nodejs*'
# RHEL 10 ships nodejs22 / nodejs24 as normal packages: sudo dnf install nodejs24

Fedora

sudo dnf upgrade --refresh nodejs22 nodejs24 (nodejsNN)

SUSE / openSUSE

sudo zypper refresh
sudo zypper update nodejs22 nodejs24

Amazon Linux

sudo dnf upgrade --releasever=latest nodejs22 nodejs24 (nodejsNN)

Arch Linux

sudo pacman -Syu

Alpine

apk update
apk upgrade nodejs          # main repo (22.x on 3.22, 24.x on 3.23/3.24)
apk upgrade nodejs-current  # community repo, if installed (26.x on 3.24)
node -v

FreeBSD

pkg update && pkg upgrade node (or node22/node24)

Docker images

# Move the FROM line to a fixed tag (or a moving major tag such as node:24-slim) and rebuild
#   FROM node:24.22.2-trixie-slim   (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v   # must be at least 22.22.0 / 24.13.0
docker compose up -d --force-recreate   # or redeploy / roll out the new image

Built from source

# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current   # or 22 / 26
nvm alias default 24
node -v   # must be at least 22.22.0 / 24.13.0 (any current 22.x/24.x/26.x release)
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2   # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -v

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

Release	Package	Status	Fixed version / advisory
Debian 12	`nodejs`	fixed	`18.20.4+dfsg-1~deb12u2`
Debian 13	`nodejs`	fixed	`20.19.2+dfsg-1+deb13u1`
Debian testing	`nodejs`	fixed	`22.22.0+dfsg+~cs22.19.6-1`
Ubuntu 25.10	`nodejs`	not planned
Ubuntu 26.10	`nodejs`	not affected
Ubuntu 26.04	`nodejs`	being checked
Ubuntu 18.04 (ESM)	`nodejs`	being checked
Ubuntu 20.04 (ESM)	`nodejs`	being checked
Ubuntu 22.04	`nodejs`	being checked
Ubuntu 24.04	`nodejs`	being checked
Red Hat Enterprise Linux 9	`nodejs:24-9070020260117213814.rhel9`	fixed	`RHSA-2026:2781`
Red Hat Enterprise Linux 9	`nodejs:22-9070020260117213838.rhel9`	fixed	`RHSA-2026:2782`
Red Hat Enterprise Linux 9	`nodejs:20-9070020260117213748.rhel9`	fixed	`RHSA-2026:2783`
Red Hat Enterprise Linux 8	`nodejs:24-8100020260116121421.6d880403`	fixed	`RHSA-2026:2420`
Red Hat Enterprise Linux 8	`nodejs:22-8100020260119091831.6d880403`	fixed	`RHSA-2026:2421`
Red Hat Enterprise Linux 8	`nodejs:20-8100020260119100525.489197e6`	fixed	`RHSA-2026:2422`
Red Hat Enterprise Linux 10	`nodejs24-1:24.13.0-1.el10_1`	fixed	`RHSA-2026:1842`
Red Hat Enterprise Linux 10	`nodejs22-1:22.22.0-3.el10_1`	fixed	`RHSA-2026:1843`
Debian 12 (bookworm)	`nodejs`	fixed	`18.20.4+dfsg-1~deb12u2 (DSA-6272-1)`
Debian 13 (trixie)	`nodejs`	fixed	`20.19.2+dfsg-1+deb13u1 (DSA-6166-1)`
RHEL 8 (nodejs:20 module)	`nodejs`	fixed	`1:20.20.0-1.module+el8.10.0+23905+c49b2aec (RHSA-2026:2422)`
RHEL 8 (nodejs:22 module)	`nodejs`	fixed	`1:22.22.0-1.module+el8.10.0+23904+2c92f862 (RHSA-2026:2421)`
RHEL 8 (nodejs:24 module)	`nodejs`	fixed	`1:24.13.0-0.module+el8.10.0+23888+24fa7806 (RHSA-2026:2420)`
RHEL 9 (nodejs:20 module)	`nodejs`	fixed	`1:20.20.0-1.module+el9.7.0+23895+0637d423 (RHSA-2026:2783)`
RHEL 9 (nodejs:22 module)	`nodejs`	fixed	`1:22.22.0-1.module+el9.7.0+23896+b5802de9 (RHSA-2026:2782)`
RHEL 9 (nodejs:24 module)	`nodejs`	fixed	`1:24.13.0-1.module+el9.7.0+23894+c8377628 (RHSA-2026:2781)`
RHEL 10	`nodejs22`	fixed	`1:22.22.0-3.el10_1 (RHSA-2026:1843)`
RHEL 10	`nodejs24`	fixed	`1:24.13.0-1.el10_1 (RHSA-2026:1842)`
Alpine 3.22	`nodejs`	fixed	`22.22.0-r0 (secdb)`

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

Until patched, attach an error handler to every secure socket of the HTTP/2 server (from the Node.js advisory): server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) })
Node.js 20.x reached end-of-life on 2026-04-30 and 25.x on 2026-06-01; supported lines on 2026-11-03 are 22.x and 24.x (Maintenance LTS) and 26.x (Active LTS). End-of-life lines get no further fixes.

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.