🎯 New Report #3658225: HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
🔺Severity: Medium
👽 Reporter: pimterry
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-08
⏰ Disclosed: 2026-06-18 17:34:31
📝 Summary: A flaw in the Node.js HTTP/2 server API was discovered that could cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affected Node.js 22 and Node.js 24.
📂 Report JSON File: 3658225
@hackeronereports