- CVE-2026-56846: http2: retain header memory in session accounting -- HandleHeadersFrame() un-charged the decoded header block from maxSessionMemory as soon as it handed it to JS, even though the JS objects can keep the block alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete keeps unbounded header memory alive while the credit-based limit reads as near zero and never rejects a new stream. The amount is now moved into a new per-stream counter, Http2Stream::retained_headers_length_, and RemoveStream() drains both counters when the stream is erased (backport of nodejs/node@f14d78b9, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test with two deviations. The header block is built as an object with a multi-valued cookie field because 14.21.3's Http2Session#request() rejects the flat array upstream passes; that one is required, or the test throws ERR_INVALID_ARG_TYPE before it ever reaches the fix. The server also raises maxHeaderListPairs to 4096, which is hardening: it puts the pair-count branch of AddHeader() structurally out of reach, leaving the session-memory branch as the only thing the test can be measuring. The wire shape still matches upstream's -- 120 cookie fields plus four pseudo-headers, 124 entries. The three doc/api/http2.md hunks are deliberately omitted, so the -docs sub-package keeps describing maxSessionMemory without the "header blocks retained by open streams" clause) - CVE-2026-56848: http2: defer rst stream while in scope -- SubmitRstStream() force-purged pending session data via SendPendingData() for every error code except NGHTTP2_CANCEL, so a RST_STREAM submitted for a refused stream from inside an nghttp2 receive callback re-entered nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on the stack, and the send path could free streams the active receive was still using (heap use-after-free, reachable by sending GOAWAY with last_stream_id 0 immediately followed by HEADERS for further streams). NGHTTP2_REFUSED_STREAM now takes the same deferred path, flushing the RST_STREAM and leaving the pending data for the enclosing Http2Scope (backport of nodejs/node@daa6d25e, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test verbatim; the cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried)