AIKIDO-2026-10030

TL;DR

Affected versions of the package are vulnerable to a crash due to improper handling of malformed HTTP/2 HEADERS frames containing oversized or invalid HPACK data. Such input can trigger an unhandled TLSSocket ECONNRESET error, causing the Node.js process to terminate instead of safely closing the connection, enabling a remote denial-of-service condition, particularly in applications without explicit secure socket error handlers.