🎯 New Report #3846922: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
🔺Severity: High
👽 Reporter: leduckhuong
⭐️ Reputation: 131
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-06
⏰ Disclosed: 2026-08-28 14:15:33
📝 Summary: A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.
📂 Report JSON File: 3846922
@hackeronereports