Node.js HTTP/2 Server Denial-of-Service Vulnerability via Malformed HEADERS Frame

A denial-of-service vulnerability has been identified in Node.js HTTP/2 server handling. When a malformed HEADERS frame containing oversized, invalid HPACK data is received, it triggers an unhandled error in the TLSSocket, causing the Node.js process to crash. This issue primarily affects applications that do not implement explicit error handlers for secure sockets, leading to a remote denial-of-service condition.

Impact

Exploitation of this vulnerability causes the Node.js process to crash, disrupting the application and potentially leading to resource exhaustion.

Remediation

Users can update to Node.js versions 25.3.0, 24.13.0, or 22.22.0, all of which include the necessary fix. Instructions for downloading these versions are available on the Node.js website.