- CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a GOAWAY for a low-level protocol error. nghttp2 calls nghttp2_session_terminate_session() itself and returns success from nghttp2_session_mem_recv() without any callback, so the Http2Session stayed live on a dead socket, holding its streams, buffers and handle -- repeatable by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now flags a GOAWAY we did not initiate and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that term of the guard is covered by the new goaway_initiated_ flag and by is_closing())