AIKIDO-2026-150674

TL;DR

The undici HTTP/2 client dispatcher retries a request indefinitely whenever the peer keeps responding with GOAWAY frames, so a misbehaving or malicious HTTP/2 server can hold a request in an unbounded connect, refuse, reconnect loop that never settles the caller's promise. Stale request and stream cleanup listeners could also fire after a session was torn down, incorrectly completing or splicing a request that had already been requeued onto another session and corrupting pool/promise state. Left unbounded, this starves the Node.js event loop and leaks pending requests under normal outbound HTTP/2 traffic to an adversarial or compromised peer. The fix caps GOAWAY-triggered replay to a single attempt and severs the old stream's listeners before a request is requeued.