undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.
CVE-2026-109855
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109855
undici
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "undici",
"product": "undici",
"versions": [
{
"status": "affected",
"version": "8.11.0",
"lessThan": "8.11.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.11.2",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/undici",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109855
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28815 · Revision 1
- Added to Heist Feed
- Publisher date