A memory leak in the Node.js HTTP/2 implementation occurs when a client sends WINDOW_UPDATE frames on the connection stream, causing the flow control window to exceed its 32‑bit signed maximum. The server sends a GOAWAY frame but fails to clean up the associated Http2Session object, allowing its memory usage to grow unchecked, which can eventually deplete system memory and result in service interruption.

Node.js 20, 22, 24, and 25 running HTTP/2 servers. The flaw resides in the core node runtime and affects any application that uses the http2 module without additional mitigation.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog, further implying a lower exploitation probability. An attacker can trigger the leak by establishing an HTTP/2 connection to the target and sending specially crafted WINDOW_UPDATE frames on stream 0. Because the flaw is triggered by client‑initiated actions, remote exploitation is possible over any open HTTP/2 port. The primary risk is resource exhaustion that could prevent legitimate traffic, which is why a patch is strongly advised.