An unauthenticated HTTP/2 client can cause a Node.js server to leak memory and file descriptors indefinitely by triggering a protocol error during session shutdown. This leaves sockets in CLOSE_WAIT state and HTTP/2 session state held in memory without release. The issue affects Node.js versions 22.x, 24.x, and 26.x and is a partial regression of a previous fix (CVE-2026-48937).