The vulnerability CVE-2025-59465 in Node.js involves a malformed HTTP/2 HEADERS frame with oversized or invalid HPACK data that triggers an unhandled TLSSocket error (ECONNRESET). Instead of gracefully closing the connection, this error causes the Node.js process to crash, enabling a remote denial of service condition. This flaw affects applications lacking explicit error handlers on secure sockets. The CVSS v3.0 base score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. Red Hat has published multiple advisories and errata providing security updates to fix this issue in their Node.js packages.

Successful exploitation of this vulnerability results in a denial of service by crashing the Node.js process handling HTTP/2 connections with malformed HPACK data. This disrupts availability of affected applications or services. There is no direct confidentiality or integrity impact reported. The vulnerability is exploitable remotely without authentication or user interaction.

Red Hat has released security updates addressing CVE-2025-59465 in their Node.js packages. Applying these official patches is the recommended remediation. Users should update to the fixed versions provided by Red Hat as detailed in their advisories. Additionally, applications should implement explicit error handlers on secure sockets to prevent unhandled exceptions leading to crashes. Patch status is confirmed by Red Hat advisories; therefore, applying the vendor-provided updates is the primary mitigation.