This vulnerability in Node.js HTTP/2 implementation allows HTTP/2 retained header blocks to bypass the maxSessionMemory limit, enabling remote attackers to cause memory exhaustion. The issue affects Node.js versions 22.23.1 and 24.18.0. The CVSS 3.0 score is 7.5 (high), indicating network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation can lead to denial of service by exhausting server memory resources remotely without requiring authentication or user interaction. This can disrupt availability of services running on affected Node.js versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of HTTP/2 services or applying resource usage monitoring and controls at the infrastructure level to mitigate potential impact.