[gabedemesa]

The documentation for maxSessionMemory says new Http2Stream instances are rejected while the limit is exceeded. That was only enforced for streams opened by the peer (Http2Session::CanAddStream()). session.request() went straight to nghttp2_submit_request(), so a client whose socket stopped draining could keep submitting requests, queuing them in nghttp2 without bound.

This checks the session memory in Http2Session::Request() before submitting and fails only that request with a new ERR_HTTP2_SESSION_MEMORY_EXCEEDED error. Nothing is sent to the peer, so the request is safe to retry, and the session stays usable. As with response headers (#67114), request bodies queued for flow control are not counted, so a large upload does not block unrelated requests on the same session.

The rejection is signalled by returning false from the internal request() binding rather than a new constant, to avoid adding to the public http2.constants or the NGHTTP2_ERR_* set that test-http2-client-onconnect-errors iterates.

Verification

test-http2-max-session-memory-client-request.js uses a minimal HTTP/2 peer on a plain TCP socket, so it can actually stop reading:

• While the peer answers requests, submitting batches of requests (yielding between batches) rejects nothing.
• Once it stops reading, requests are rejected with ERR_HTTP2_SESSION_MEMORY_EXCEEDED and the session stays open.
• After it reads again, a retried request is accepted on the same session.
• A request with a large upload queued for flow control does not block another request.

The test fails on v26.13.1 and fails if the peer is not stalled. All test/parallel/test-http2-* and test/sequential/test-http2-* tests pass locally, as do test-http2-client-onconnect-errors and test-internal-errors. cpplint, ESLint and lint-md are clean.

Not covered

• A single stream that ignores write() backpressure can still queue without bound on that stream (also described in the issue). That is application-level backpressure.
• This does not fix the production OOM reported in HTTP/2: client session outgoing queue grows without bound (Http2Session::CopyDataIntoOutgoing), OOM-killing the process undici#6181. That crash has since been reproduced, still reproduces with this change, and is being handled separately. This PR only enforces the documented maxSessionMemory limit for locally initiated requests.

Refs: nodejs/undici#6181

[nodejs-github-bot]

Review requested:

• @nodejs/http2
• @nodejs/net

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

[inoway46]

Thanks for working on this. I built it locally and the fix works as described. Three things inline.

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.69%. Comparing base (75d55af) to head (a8fbede).
⚠️ Report is 68 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_http2.cc	71.42%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #67361      +/-   ##
==========================================
- Coverage   90.73%   90.69%   -0.04%     
==========================================
  Files         798      802       +4     
  Lines      280017   282123    +2106     
  Branches    53852    54364     +512     
==========================================
+ Hits       254064   255883    +1819     
- Misses      16236    16361     +125     
- Partials     9717     9879     +162     

Files with missing lines	Coverage Δ
lib/internal/errors.js	98.12% <100.00%> (+<0.01%)	⬆️
lib/internal/http2/core.js	94.93% <100.00%> (+0.01%)	⬆️
src/node_http2.cc	82.18% <71.42%> (+0.16%)	⬆️

... and 79 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[inoway46]

Thanks for the updates. I rebuilt 99f430c and all three points are addressed. The new test passed 300 repeated runs for me. Two non-blocking suggestions inline.

One process note: the commit has a Co-Authored-By: trailer naming an AI tool. AGENTS.md asks for Assisted-by: instead, and the AI guidelines recommend keeping commercial tool names out of commit messages, so that will probably need changing before this can land.

[gabedemesa]

Thanks for the approval. The commit now uses Assisted-by: and a full-name sign-off.