From 663f666fdaedb920d87371468324c909fee2cf2e Mon Sep 17 00:00:00 2001
From: Huang-404-Q <129407632+Huang-404-Q@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:31:19 +0800
Subject: [PATCH] http2: clear the session timeout before marking it destroyed

closeSession() set SESSION_FLAGS_DESTROYED and then called
session.setTimeout(0). setStreamTimeout() returns early when the
session is destroyed, so the idle timer stayed armed and retained
the session until the server timeout fired.

Clear the timeout and remove its listeners before setting the
destroyed flag.

Fixes: https://github.com/nodejs/node/issues/66885
Signed-off-by: huang <13165998033@163.com>
PR-URL: https://github.com/nodejs/node/pull/66886
Reviewed-By: Tim Perry <pimterry@gmail.com>
---
 lib/internal/http2/core.js                    |  9 +++--
 ...ion-timeout-cleared-on-close-raw-socket.js | 38 +++++++++++++++++++
 ...-http2-session-timeout-cleared-on-close.js | 32 ++++++++++++++++
 3 files changed, 76 insertions(+), 3 deletions(-)
 create mode 100644 test/parallel/test-http2-session-timeout-cleared-on-close-raw-socket.js
 create mode 100644 test/parallel/test-http2-session-timeout-cleared-on-close.js

diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 011cf22210f..04acb5d30f6 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -1303,13 +1303,16 @@ function closeSession(session, code, error) {
   debugSessionObj(session, 'start closing/destroying', error);
 
   const state = session[kState];
-  state.flags |= SESSION_FLAGS_DESTROYED;
-  state.destroyCode = code;
 
-  // Clear timeout and remove timeout listeners.
+  // Clear timeout and remove timeout listeners before marking the session
+  // destroyed: setTimeout() is a no-op once destroyed, so the idle timer
+  // would otherwise stay armed and retain the session.
   session.setTimeout(0);
   session.removeAllListeners('timeout');
 
+  state.flags |= SESSION_FLAGS_DESTROYED;
+  state.destroyCode = code;
+
   const socket = session[kSocket];
   const handle = session[kHandle];
 
diff --git a/test/parallel/test-http2-session-timeout-cleared-on-close-raw-socket.js b/test/parallel/test-http2-session-timeout-cleared-on-close-raw-socket.js
new file mode 100644
index 00000000000..1df70ec9b52
--- /dev/null
+++ b/test/parallel/test-http2-session-timeout-cleared-on-close-raw-socket.js
@@ -0,0 +1,38 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const net = require('net');
+
+// Same as test-http2-session-timeout-cleared-on-close.js, but the client's
+// TCP socket is destroyed without sending GOAWAY.
+const server = http2.createServer();
+server.setTimeout(30_000, common.mustNotCall());
+
+server.on('session', common.mustCall((session) => {
+  session.on('goaway', common.mustNotCall());
+  session.on('close', common.mustCall(() => {
+    assert.strictEqual(session.timeout, 0);
+    server.close();
+  }));
+}));
+
+server.on('stream', common.mustCall((stream) => {
+  stream.respond({ ':status': 200 });
+  stream.end('ok');
+}));
+
+server.listen(0, common.mustCall(() => {
+  let socket;
+  const client = http2.connect(`http://localhost:${server.address().port}`, {
+    createConnection: (url) => (socket = net.connect(url.port, url.hostname)),
+  });
+  client.on('error', () => {});
+  const req = client.request();
+  req.on('error', () => {});
+  req.resume();
+  req.on('end', common.mustCall(() => socket.destroy()));
+}));
diff --git a/test/parallel/test-http2-session-timeout-cleared-on-close.js b/test/parallel/test-http2-session-timeout-cleared-on-close.js
new file mode 100644
index 00000000000..476e60702ab
--- /dev/null
+++ b/test/parallel/test-http2-session-timeout-cleared-on-close.js
@@ -0,0 +1,32 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A destroyed session must not keep its idle timer armed: setTimeout() is a
+// no-op once the session is marked destroyed, so closeSession() has to clear
+// the timer first.
+const server = http2.createServer();
+server.setTimeout(30_000, common.mustNotCall());
+
+server.on('session', common.mustCall((session) => {
+  session.on('close', common.mustCall(() => {
+    assert.strictEqual(session.timeout, 0);
+    server.close();
+  }));
+}));
+
+server.on('stream', common.mustCall((stream) => {
+  stream.respond({ ':status': 200 });
+  stream.end('ok');
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = http2.connect(`http://localhost:${server.address().port}`);
+  const req = client.request();
+  req.resume();
+  req.on('end', common.mustCall(() => client.close()));
+}));