A flaw in Node.js HTTP/2 handling allows retained header blocks to bypass the maxSessionMemory limit, enabling an attacker to trigger memory exhaustion. This leads to high memory consumption that can crash or stall services, resulting in a denial of service. The weakness is identified as CWE-400, indicating unvalidated input causes resource exhaustion.

Node.js 24.x and 22.x versions are affected. Any deployment running these versions that exposes HTTP/2 endpoints is at risk.

The CVSS score of 7.5 signals high severity. The EPSS score is < 1%, indicating a very low but non-zero exploitation probability. It is not listed in CISA’s KEV catalog, meaning no known exploited instances yet. Attackers would need to send crafted HTTP/2 requests to the vulnerable endpoint. Based on the description, the likely attack vector is HTTP/2 traffic, requiring network access to the server. The risk manifests as denial-of-service through uncontrolled memory consumption, potentially impacting multiple users on the same host.