[inoway46]

close() with NO_ERROR waits for 'finish' before sending RST_STREAM. If the body is stuck behind flow control and the stream is destroyed first, RST_STREAM is never sent and nghttp2 keeps the stream open. On the next WINDOW_UPDATE, OnRead finds no stream and returns 0 without EOF, so nghttp2 sends empty DATA frames in a loop until the process runs out of memory.

The issue reports this for client requests, but server responses are affected in the same way.

Send the deferred RST_STREAM in _destroy(). As a backstop, return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE from OnRead when the stream is gone, which nghttp2 documents as the way to reset a stream on error. Add regression tests for client and server streams.

Both tests run out of memory on current main, v22.23.4, v24.22.2 and v26.13.0, and pass with this change.

Fixes: #67363

[nodejs-github-bot]

Review requested:

• @nodejs/http2
• @nodejs/net

[codecov]

Codecov Report

❌ Patch coverage is 94.11765% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.71%. Comparing base (2929073) to head (7288a16).
⚠️ Report is 65 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_http2.cc	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #67372      +/-   ##
==========================================
- Coverage   92.62%   90.71%   -1.91%     
==========================================
  Files         430      798     +368     
  Lines      196333   280032   +83699     
  Branches    29897    53860   +23963     
==========================================
+ Hits       181849   254038   +72189     
- Misses      14159    16283    +2124     
- Partials      325     9711    +9386     

Files with missing lines	Coverage Δ
lib/internal/http2/core.js	94.94% <100.00%> (+0.14%)	⬆️
src/node_http2.cc	82.02% <0.00%> (ø)

... and 508 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gabedemesa]

I tested this against the production case in nodejs/undici#6181: a Node 26.12.1 service using fetch over HTTP/2 that was OOM-killed in Http2Session::CopyDataIntoOutgoing.

With this commit cherry-picked onto main at 75d55af (macOS arm64), none of the following run away. Without it, each one exceeds 1.5 GB of RSS within about a second on v26.12.1:

• Two or more concurrent fetch() POSTs with 32 KB bodies, aborted mid-upload.
• A server that advertises a zero initial window, waits for the client's AbortSignal.timeout() to fire, then raises the window.
• Plain node:http2: close() followed by destroy() while the body is still queued.
• 5,000 aborted uploads with random body sizes against a slow reader.

The parallel/test-http2-* and sequential/test-http2-* suites pass with the change.

We are hitting this in production: a Node 26.12.1 service using fetch over HTTP/2 is being OOM-killed (details in nodejs/undici#6181). Could this be considered for review, and for backporting to v26.x and v24.x once it lands? Thank you.

[pimterry]

Looks like we'll need manual backports for this

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/79006/

[gabedemesa]

Looks like we'll need manual backports for this

raised backports, will rebase them once this is merged.

• v24: [v24.x backport] http2: send deferred RST_STREAM on stream destroy #67445
• v26: [v26.x backport] http2: send deferred RST_STREAM on stream destroy #67444

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/79016/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/79022/

[jazelly]

lgtm

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/79050/

[nodejs-github-bot]

Landed in f8ab610