CVE-2026-109855
7.5HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248, CWE-754
Impact
A malicious remote server can crash your Node.js application process by aborting a WebSocket connection over HTTP/2. The attacker only needs your application to connect to their WebSocket endpoint.
Root cause
A failed WebSocket handshake over HTTP/2 marks the request completed early, leaving an orphaned HTTP/2 stream with no error listener that crashes the process on an unhandled error when the server destroys the connection.
Affected systems
undici 8.11.0 and 8.11.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to undici 8.11.2 or later. If you cannot upgrade immediately, set allowH2 to false in your WebSocket client configuration or avoid connecting to untrusted WebSocket servers.
$ npm install undici@^8.11.2AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.