A flaw in Node.js HTTP/2 server API allows a server to continue accepting data after a GOAWAY frame has been sent, resulting in continued resource consumption and potential exhaustion of system memory or network capacity. The vulnerability is a classic example of an uncontrolled resource consumption flaw (CWE-400), and an attacker could trigger repeated GOAWAY frames and data streams to degrade service availability. No direct code execution or data exfiltration is implied by the description.

The vulnerability affects the Node.js runtime provided by the private nodejs:node vendor. It is known to affect the 22 and 24 release lines, which include current stable releases targeted at production usage.

The CVSS score for the flaw is 5.3, indicating moderate severity. Because the EPSS score is not available, the probability of exploitation in the wild remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious HTTP/2 client sending crafted frames to a Node.js server that has enabled HTTP/2 support. Exploitation requires network access to the target and the victim's server must be configured to use the default HTTP/2 API; no user interaction or privilege escalation is required.