Live › vulnerability › CVE-2026-109855
Go to dashboardundici's experimental WebSocket client, on by default over HTTP/2, leaves a stream without an error listener when a server returns a malformed upgrade response. When the server then drops the connection, the unhandled error exits the Node.js process. A remote, unauthenticated server can crash any client that opens a WebSocket to it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:10 UTC, 0h before NVD. All times on this page are UTC.
Applications running undici 8.11.0 or 8.11.1 that open WebSocket connections, since HTTP/2 WebSocket support is enabled by default. The exposure is strongest for clients that connect to servers outside the team's control. Services that only use undici for plain HTTP requests, or that pin an older major line, are not affected by this WebSocket path.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| undici | npm | >= 8.11.0, < 8.11.2 | 8.11.2 |
| nodejs undici | vendor | >= 8.11.0, < 8.11.2 | 8.11.2 |
node -e "console.log(require('undici/package.json').version)" in the project and check whether it prints 8.11.0 or 8.11.1npm ls undici to find transitive copies pulled in by other packagesundici entries resolving to 8.11.0 or 8.11.1undici to 8.11.2 or later, then reinstall and redeployallowH2: false in the WebSocket client options to disable HTTP/2 for WebSocket connectionsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.
Upgrade to 8.11.2.
Set allowH2: false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers, until upgrading.
This page as .md · .json · in your agent: get_signal("CVE-2026-109855")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.