Ronag

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK EQ(current nghttp2 memory , 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

The experimental WebSocket client in this Node.js HTTP client library mishandles failed WebSocket handshakes over HTTP/2. Because the request is marked as completed, the abort operation is ignored, leaving the underlying HTTP/2 stream open without an error listener. A remote, unauthenticated server can trigger a denial of service by destroying the connection, causing the orphaned stream to emit an unhandled error that crashes the Node.js process.