A memory leak in Node.js HTTP/2 servers occurs when the server receives WINDOW_UPDATE frames on stream 0 that increase the flow control window beyond 2³¹-1. The server sends a GOAWAY frame to terminate the connection but does not clean up the Http2Session object. The retained session consumes memory, leading to resource exhaustion and enabling a denial‑of‑service attack. This weakness falls under memory management and resource cleanup failures, aligned with CWE‑401 and CWE‑772.

The flaw is present in Node.js HTTP/2 implementations running versions 20, 22, 24, and 25. Systems that expose HTTP/2 services and are built on these Node.js releases are vulnerable. No other Node.js versions were listed as affected.

The CVSS score of 5.3 indicates a medium severity, reflecting that the attack requires a client that can send crafted HTTP/2 frames. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. Exploitation would involve a remote client sending oversized WINDOW_UPDATE frames over an HTTP/2 connection; because the server spawns an unreleased session, persistent memory use can culminate in service disruption.