diff --git a/src/node_http2.cc b/src/node_http2.cc
index fb23cb0f51073c..5e7b484886f801 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -1277,7 +1277,11 @@ int Http2Session::HandleDataFrame(const nghttp2_frame* frame) {
       frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
     stream->EmitRead(UV_EOF);
   } else if (frame->hd.length == 0) {
-    return 1;  // Consider 0-length frame without END_STREAM an error.
+    if (invalid_frame_count_++ > js_fields_->max_invalid_frames) {
+      Debug(this, "rejecting empty-frame-without-END_STREAM flood\n");
+      // Consider a flood of 0-length frames without END_STREAM an error.
+      return 1;
+    }
   }
   return 0;
 }
diff --git a/test/fixtures/emptyframe.http2 b/test/fixtures/emptyframe.http2
new file mode 100644
index 00000000000000..c4a095c4334529
Binary files /dev/null and b/test/fixtures/emptyframe.http2 differ
diff --git a/test/parallel/test-http2-empty-frame-without-eof.js b/test/parallel/test-http2-empty-frame-without-eof.js
new file mode 100644
index 00000000000000..02da78d940a92d
--- /dev/null
+++ b/test/parallel/test-http2-empty-frame-without-eof.js
@@ -0,0 +1,39 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const { readSync } = require('../common/fixtures');
+const net = require('net');
+const http2 = require('http2');
+const { once } = require('events');
+
+async function main() {
+  const blobWithEmptyFrame = readSync('emptyframe.http2');
+  const server = net.createServer((socket) => {
+    socket.end(blobWithEmptyFrame);
+  }).listen(0);
+  await once(server, 'listening');
+
+  for (const maxSessionInvalidFrames of [0, 2]) {
+    const client = http2.connect(`http://localhost:${server.address().port}`, {
+      maxSessionInvalidFrames
+    });
+    const stream = client.request({
+      ':method': 'GET',
+      ':path': '/'
+    });
+    if (maxSessionInvalidFrames) {
+      stream.on('error', common.mustNotCall());
+      client.on('error', common.mustNotCall());
+    } else {
+      stream.on('error', common.mustCall());
+      client.on('error', common.mustCall());
+    }
+    stream.resume();
+    await once(stream, 'end');
+    client.close();
+  }
+  server.close();
+}
+
+main().then(common.mustCall());