diff --git a/doc/api/quic.md b/doc/api/quic.md
index 7a52e4f72c1f..d40827f57e32 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -305,7 +305,11 @@ unidirectional (data flows in only one direction). The `quic` module provides
 separate APIs for creating each kind:
 [`session.createBidirectionalStream()`][] and
 [`session.createUnidirectionalStream()`][]. Streams initiated by a remote
-peer are delivered via the [`session.onstream`][] callback.
+peer are delivered via the [`session.onstream`][] callback. When the
+negotiated application protocol supports the stream-level callbacks (e.g.
+HTTP/3) and an `onheaders` callback is configured, incoming streams can
+instead be consumed entirely through it and registering `onstream` is
+optional.
 
 There are two ways to write data to a stream:
 
@@ -409,7 +413,9 @@ A typical client session progresses through these stages:
 
 On the server side, call [`quic.listen()`][] with a callback. The callback
 fires for each incoming session after the TLS handshake begins. Incoming
-streams arrive via the [`session.onstream`][] callback.
+streams arrive via the [`session.onstream`][] callback, or, for HTTP/3
+sessions with an `onheaders` callback configured, directly through that
+callback (see the [minimal HTTP/3 server][] example).
 
 [`session.destroy()`][] is available for immediate teardown — all open streams
 are destroyed and the session is closed without waiting for them to finish.
@@ -1110,6 +1116,15 @@ added: v23.8.0
 
 The callback to invoke when a new stream is initiated by a remote peer. Read/write.
 
+If no `onstream` callback is set and the stream has no other consumer, an
+incoming stream is destroyed on arrival and a warning is emitted. An
+`onheaders` callback counts as a consumer when the negotiated application
+protocol supports it (e.g. HTTP/3), because it is invoked for every incoming
+request stream. Other stream-level callbacks (`ontrailers`, `oninfo`,
+`onwanttrailers`) do not, since they are conditional or outbound-only and
+would leave the stream unobservable. An HTTP/3 server that handles requests
+entirely through `onheaders` does not need to set `onstream`.
+
 ### `session.ondatagram`
 
 <!-- YAML
@@ -4008,7 +4023,9 @@ import { listen } from 'node:quic';
 const encoder = new TextEncoder();
 
 const endpoint = await listen((session) => {
-  // The session.onstream callback fires for each new client-initiated stream.
+  // The session.onstream callback fires for each new client-initiated
+  // stream. It is optional here: with `onheaders` configured below,
+  // request streams are consumed through that callback.
 }, {
   sni: { '*': { keys: [defaultKey], certs: [defaultCert] } },
   // ALPN defaults to 'h3'.
@@ -4642,5 +4659,6 @@ throughput issues caused by flow control.
 [`stream.writer`]: #streamwriter
 [`writer.fail()`]: #streamwriter
 [`writer.fail(reason)`]: #streamwriter
+[minimal HTTP/3 server]: #minimal-http3-server
 [qlog]: https://datatracker.ietf.org/doc/draft-ietf-quic-qlog-main-schema/
 [qvis]: https://qvis.quictools.info/
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index f645998e628d..e6ab417ab0f6 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -4129,6 +4129,24 @@ class QuicSession {
     this.#inner.verifyPeer = value;
   }
 
+  /**
+   * True if an incoming stream has a consumer registered on this session:
+   * either an onstream callback, or - when the negotiated application
+   * supports headers (e.g. HTTP/3) - session-level stream callbacks that
+   * the application layer will invoke (onheaders et al).
+   * @returns {boolean}
+   */
+  #hasStreamConsumer() {
+    if (typeof this.#inner.onstream === 'function') return true;
+    // Only onheaders is guaranteed to fire for every incoming stream when
+    // the negotiated application supports stream callbacks (e.g. HTTP/3).
+    // Other stream callbacks are conditional (ontrailers, oninfo) or
+    // outbound-only (onwanttrailers) and do not expose the stream, so they
+    // do not count as a consumer.
+    if (typeof this[kStreamCallbacks]?.onheaders !== 'function') return false;
+    return getQuicSessionState(this).streamCallbacksSupported === 1;
+  }
+
   /**
    * @param {object} handle
    * @param {number} direction
@@ -4141,10 +4159,13 @@ class QuicSession {
     // Set the default byte budget for received streams.
     stream.budget = kDefaultBudget;
 
-    // A new stream was received. If we don't have an onstream callback, then
-    // there's nothing we can do about it. Destroy the stream in this case.
-    if (typeof inner.onstream !== 'function') {
-      process.emitWarning('A new stream was received but no onstream callback was provided');
+    // A new stream was received. If the session has no consumer for it -
+    // neither an onstream callback nor, on a session whose application
+    // supports headers (e.g. HTTP/3), any session-level stream callbacks -
+    // there's nothing that could ever read it. Destroy the stream in this
+    // case rather than letting it hold flow control credit.
+    if (!this.#hasStreamConsumer()) {
+      process.emitWarning('A new stream was received but no stream consumer callback was provided');
       stream.destroy();
       return;
     }
@@ -4175,7 +4196,14 @@ class QuicSession {
       });
     }
 
-    safeCallbackInvoke(inner.onstream, this, stream);
+    // Deliver the stream to the onstream consumer if one is registered.
+    // Reaching this point without one means #hasStreamConsumer accepted
+    // the stream on behalf of the application layer: the session-level
+    // stream callbacks were applied above and the application (e.g.
+    // HTTP/3) drives the stream, so there is nothing to invoke here.
+    if (typeof inner.onstream === 'function') {
+      safeCallbackInvoke(inner.onstream, this, stream);
+    }
   }
 
   [kRemoveStream](stream) {
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index 7d2ff3a96c6b..a41790c52024 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -72,6 +72,7 @@ const {
   IDX_STATE_SESSION_STREAM_OPEN_ALLOWED,
   IDX_STATE_SESSION_PRIORITY_SUPPORTED,
   IDX_STATE_SESSION_HEADERS_SUPPORTED,
+  IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED,
   IDX_STATE_SESSION_WRAPPED,
   IDX_STATE_SESSION_APPLICATION_TYPE,
   IDX_STATE_SESSION_NO_ERROR_CODE,
@@ -119,6 +120,7 @@ assert(IDX_STATE_SESSION_HANDSHAKE_CONFIRMED !== undefined);
 assert(IDX_STATE_SESSION_STREAM_OPEN_ALLOWED !== undefined);
 assert(IDX_STATE_SESSION_PRIORITY_SUPPORTED !== undefined);
 assert(IDX_STATE_SESSION_HEADERS_SUPPORTED !== undefined);
+assert(IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED !== undefined);
 assert(IDX_STATE_SESSION_WRAPPED !== undefined);
 assert(IDX_STATE_SESSION_APPLICATION_TYPE !== undefined);
 assert(IDX_STATE_SESSION_NO_ERROR_CODE !== undefined);
@@ -493,6 +495,19 @@ class QuicSessionState {
     return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_SESSION_HEADERS_SUPPORTED);
   }
 
+  /**
+   * Whether the negotiated application dispatches the session-level
+   * stream callbacks (onheaders et al) for incoming streams.
+   * Returns 0 (unknown), 1 (supported), or 2 (not supported).
+   * @type {number}
+   */
+  get streamCallbacksSupported() {
+    const handle = this.#handle;
+    if (handle === undefined) return undefined;
+    return DataViewPrototypeGetUint8(
+      handle, this.#offset + IDX_STATE_SESSION_STREAM_CALLBACKS_SUPPORTED);
+  }
+
   /** @type {boolean} */
   get isWrapped() {
     const handle = this.#handle;
diff --git a/src/quic/application.h b/src/quic/application.h
index 619b41dd8d0b..dec5cffb4243 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -210,6 +210,11 @@ class Session::Application : public MemoryRetainer {
   // do not support headers should return false (the default).
   virtual bool SupportsHeaders() const { return false; }
 
+  // True if this application dispatches the session-level stream
+  // callbacks (onheaders et al) for incoming streams when they are
+  // registered on the session.
+  virtual bool SupportsStreamCallbacks() const { return false; }
+
   // Initiates application-level graceful shutdown signaling (e.g.,
   // HTTP/3 GOAWAY). Called when Session::Close(GRACEFUL) is invoked.
   virtual void BeginShutdown() {}
diff --git a/src/quic/defs.h b/src/quic/defs.h
index 75ae915335be..5184288475b1 100644
--- a/src/quic/defs.h
+++ b/src/quic/defs.h
@@ -328,6 +328,12 @@ enum class HeadersSupportState : uint8_t {
   UNSUPPORTED,
 };
 
+enum class StreamCallbacksSupportState : uint8_t {
+  UNKNOWN,
+  SUPPORTED,
+  UNSUPPORTED,
+};
+
 enum class PathValidationResult : uint8_t {
   SUCCESS = NGTCP2_PATH_VALIDATION_RESULT_SUCCESS,
   FAILURE = NGTCP2_PATH_VALIDATION_RESULT_FAILURE,
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index b6d876af60f6..2cf4e2d6fdd1 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -202,6 +202,8 @@ class Http3ApplicationImpl final : public Session::Application {
 
   bool SupportsHeaders() const override { return true; }
 
+  bool SupportsStreamCallbacks() const override { return true; }
+
   bool is_started() const override { return started_; }
 
   bool Start() override {
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 1bea15fbadb4..60b27fbfa358 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -136,6 +136,7 @@ uint64_t MaxDatagramPayload(uint64_t max_frame_size) {
   V(STREAM_OPEN_ALLOWED, stream_open_allowed, uint8_t)                         \
   V(PRIORITY_SUPPORTED, priority_supported, uint8_t)                           \
   V(HEADERS_SUPPORTED, headers_supported, uint8_t)                             \
+  V(STREAM_CALLBACKS_SUPPORTED, stream_callbacks_supported, uint8_t)           \
   V(WRAPPED, wrapped, uint8_t)                                                 \
   V(APPLICATION_TYPE, application_type, uint8_t)                               \
   V(NO_ERROR_CODE, no_error_code, error_code)                                  \
@@ -2649,6 +2650,10 @@ void Session::SetApplication(std::unique_ptr<Application> app) {
   impl_->state()->headers_supported = static_cast<uint8_t>(
       app->SupportsHeaders() ? HeadersSupportState::SUPPORTED
                              : HeadersSupportState::UNSUPPORTED);
+  impl_->state()->stream_callbacks_supported =
+      static_cast<uint8_t>(app->SupportsStreamCallbacks()
+                               ? StreamCallbacksSupportState::SUPPORTED
+                               : StreamCallbacksSupportState::UNSUPPORTED);
   // Surface the application's "no error" and "internal error" codes via
   // session state so that JS-side code (e.g. the stream writer's fail()
   // path) can resolve the right wire code for the negotiated ALPN
diff --git a/test/parallel/test-quic-h3-stream-without-onstream.mjs b/test/parallel/test-quic-h3-stream-without-onstream.mjs
new file mode 100644
index 000000000000..fcd5bbe019ba
--- /dev/null
+++ b/test/parallel/test-quic-h3-stream-without-onstream.mjs
@@ -0,0 +1,244 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Test: incoming stream consumer checks.
+// An incoming stream must not be destroyed just because `onstream` is
+// not set: on a session whose application supports headers (HTTP/3),
+// session-level stream callbacks (`onheaders` et al) are a consumer
+// and the stream must be kept and driven by the application layer.
+// Refs: https://github.com/nodejs/node/issues/64192
+//
+// A session with no stream consumers at all still destroys incoming
+// streams (and emits a warning), so unconsumed streams cannot
+// accumulate and hold flow control credit.
+
+import { hasQuic, skip, mustCall, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+const { text } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+// The consumer warning must never fire in the first block (onheaders is
+// a consumer) and must fire in the second (no runnable consumer).
+// common.expectWarning is not usable here: importing node:quic emits
+// ExperimentalWarning, which it would reject as unexpected.
+const kWarning =
+  'A new stream was received but no stream consumer callback was provided';
+function failOnConsumerWarning(warning) {
+  assert.notStrictEqual(warning.message, kWarning);
+}
+
+// --- An h3 request completes with only session-level stream callbacks ---
+{
+  process.on('warning', failOnConsumerWarning);
+  const serverDone = Promise.withResolvers();
+
+  // Note: no `onstream` callback anywhere on this session.
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onheaders: mustCall(function(headers) {
+      assert.strictEqual(headers[':path'], '/test');
+      this.sendHeaders({
+        ':status': '200',
+        'content-type': 'text/plain',
+      });
+      const w = this.writer;
+      w.writeSync('kept without onstream');
+      w.endSync();
+      serverDone.resolve();
+    }),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const headersReceived = Promise.withResolvers();
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+    onheaders: mustCall((headers) => {
+      assert.strictEqual(headers[':status'], 200);
+      headersReceived.resolve();
+    }),
+  });
+
+  await headersReceived.promise;
+  const body = await text(stream);
+  assert.strictEqual(body, 'kept without onstream');
+
+  await serverDone.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+  process.off('warning', failOnConsumerWarning);
+}
+
+// --- Stream callbacks that cannot run are not a consumer ---
+// On a session whose negotiated application does not support headers,
+// registered session-level stream callbacks can never fire, so an
+// incoming stream with no onstream callback is destroyed with the
+// warning. The h3 block above must not trigger that warning.
+{
+  // Awaiting warned.promise is the assertion: the test times out if the
+  // warning never fires.
+  const warned = Promise.withResolvers();
+  process.on('warning', function onWarning(warning) {
+    if (warning.message === kWarning) {
+      process.off('warning', onWarning);
+      warned.resolve();
+    }
+  });
+
+  // The onheaders callback is registered but the ALPN is not h3,
+  // so it can never run.
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    alpn: ['test-proto'],
+    onheaders: () => {},
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    alpn: 'test-proto',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const stream = await clientSession.createUnidirectionalStream();
+  stream.writer.writeSync('x');
+
+  await warned.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// Session-level stream callbacks, classified by whether the application is
+// guaranteed to hand every incoming stream to that callback. `onheaders` is
+// invoked for every incoming h3 request stream; the others are conditional
+// (`ontrailers`, `oninfo`) or outbound-only (`onwanttrailers`) and do not
+// expose the stream, so registering only those is not a consumer.
+const kConsumerCallbacks = ['onheaders'];
+const kNonConsumerCallbacks = ['oninfo', 'ontrailers', 'onwanttrailers'];
+
+// --- Every session-level stream callback is classified ---
+// Guard: discover the callbacks the session attaches to an incoming stream
+// and assert each one is classified above, so a newly added stream callback
+// trips this test until someone puts it in the right list (and, if it is a
+// consumer, accepts it in QuicSession#hasStreamConsumer).
+{
+  // QuicStream is not exported; obtain its prototype from a stream instance,
+  // then offer every `on*` accessor to listen() and see which ones the
+  // session actually attaches to a received stream.
+  const bootstrap = await listen(mustCall((session) => {
+    session.onerror = () => {};
+  }), { sni: { '*': { keys: [key], certs: [cert] } }, onstream: () => {} });
+  const bootSession = await connect(bootstrap.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await bootSession.opened;
+  const probeStream = await bootSession.createBidirectionalStream();
+  probeStream.onerror = () => {};
+  const candidates = Object.getOwnPropertyNames(Object.getPrototypeOf(probeStream))
+    .filter((name) => name.startsWith('on'));
+  await bootSession.close();
+  await bootstrap.close();
+
+  const probes = { __proto__: null };
+  for (const name of candidates) probes[name] = () => {};
+
+  const applied = Promise.withResolvers();
+  const serverEndpoint = await listen(mustCall((session) => {
+    session.onerror = () => {};
+  }), {
+    __proto__: null,
+    ...probes,
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onstream: mustCall((stream) => {
+      applied.resolve(candidates.filter((n) => typeof stream[n] === 'function'));
+    }),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+  stream.onerror = () => {};
+
+  assert.deepStrictEqual(
+    (await applied.promise).sort(),
+    [...kConsumerCallbacks, ...kNonConsumerCallbacks].sort(),
+    'A session-level stream callback was added: classify it in ' +
+    'kConsumerCallbacks (and accept it in QuicSession#hasStreamConsumer) ' +
+    'or kNonConsumerCallbacks.');
+
+  await clientSession.close();
+  await serverEndpoint.close();
+}
+
+// --- Callbacks that do not expose the stream are not a consumer ---
+// A session registering only a non-consumer callback has no way to observe
+// an incoming stream, so it must be destroyed with the warning.
+for (const callbackName of kNonConsumerCallbacks) {
+  const warned = Promise.withResolvers();
+  process.on('warning', function onWarning(warning) {
+    if (warning.message === kWarning) {
+      process.off('warning', onWarning);
+      warned.resolve();
+    }
+  });
+
+  const serverEndpoint = await listen(mustCall((serverSession) => {
+    serverSession.onerror = () => {};
+  }), {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    [callbackName]: mustNotCall(),
+  });
+
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+
+  const stream = await clientSession.createBidirectionalStream({
+    headers: {
+      ':method': 'GET',
+      ':path': '/test',
+      ':scheme': 'https',
+      ':authority': 'localhost',
+    },
+  });
+  stream.onerror = () => {};
+
+  await warned.promise;
+  await clientSession.close();
+  await serverEndpoint.close();
+}