HTTP/2 Session Cache Fragmentation via Non-Canonical Option Equivalence
Behavioral analysis of transport option structural equality causing HTTP/2 session pool fragmentation under dynamically generated semantically equivalent configurations.
When requests target the same authority but supply dynamically varying http2Options objects containing irrelevant undefined-valued keys, Axios allocates distinct HTTP/2 sessions rather than reusing existing pooled sessions. This produces linear session growth, increased socket handle count, and elevated memory consumption under repeated request execution.
No confidentiality, integrity, or isolation boundary violation was observed. No cross-session leakage, authority confusion, memory corruption, authentication bypass, or remote code execution primitive was identified. The behavior is best classified as an operational resource-efficiency caveat relevant to application-layer transport configuration normalization.
Applications deriving http2Options dynamically should normalize transport configuration objects prior to Axios invocation. Implement deterministic allowlisting, canonical ordering, and elimination of semantically irrelevant undefined-valued properties before request dispatch. Multi-tenant transport wrappers should avoid exposing raw low-level HTTP/2 transport options directly to untrusted request context.
[CONTROL] i=250 rss=53MB heap=13MB handles=3
Active sessions: 1[FRAGMENTED] i=250 rss=68MB heap=17MB handles=254
Active sessions: ~300View PoC code
const client = axios.create({
baseURL: "http://localhost:3002",
httpVersion: 2,
http2Options: {
sessionTimeout: 30000,
["irrelevant_" + i]: undefined
}
});
for (let i = 0; i < 300; i++) {
await client.get("/");
}View mitigation code
const stableClient = axios.create({
baseURL: "http://localhost:3002",
httpVersion: 2,
http2Options: {
sessionTimeout: 30000
}
});View FRES detection heuristic
Flag runtime patterns where semantically equivalent transport configuration objects are reconstructed per request with varying shape but identical transport semantics.