{"id":"CVE-2026-109855","kind":"vulnerability","aliases":["CVE-2026-109855","GHSA-qq8j-7v2v-3rwp"],"related":[],"title":"undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake","description":"### Impact\n\nundici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying `ClientHttp2Stream` is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled `error` and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.\n\n### Patches\n\nUpgrade to `8.11.2`.\n\n### Workarounds\n\nSet `allowH2: false` to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers, until upgrading.","summary":"undici's experimental WebSocket client, on by default over HTTP/2, leaves a stream without an error listener when a server returns a malformed upgrade response. When the server then drops the connection, the unhandled error exits the Node.js process. A remote, unauthenticated server can crash any client that opens a WebSocket to it.","severity":"high","cvss":7.5,"epss":0.00279,"exploited":false,"exploited_at":null,"products":[{"name":"undici","fixed":["8.11.2"],"affected":">= 8.11.0, < 8.11.2","ecosystem":"npm"},{"name":"nodejs undici","fixed":["8.11.2"],"affected":">= 8.11.0, < 8.11.2","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-248","cwe-754","http2","node","package","undici","websocket"],"not_affected_if":["default-config-off","no-websocket-use","pinned-below-8.11.0"],"how_to_check":"- Run `node -e \"console.log(require('undici/package.json').version)\"` in the project and check whether it prints `8.11.0` or `8.11.1`\n- Run `npm ls undici` to find transitive copies pulled in by other packages\n- Search lockfiles for `undici` entries resolving to `8.11.0` or `8.11.1`","fix":"- Upgrade `undici` to `8.11.2` or later, then reinstall and redeploy\n- Until upgraded, set `allowH2: false` in the WebSocket client options to disable HTTP/2 for WebSocket connections\n- Until upgraded, avoid opening WebSocket connections to servers you do not trust","status":"open","published_at":"2026-10-15T09:17:16+00:00","first_seen_at":"2026-10-27T16:10:07+00:00","triaged_at":"2026-10-27T16:10:54+00:00","updated_at":"2026-10-27T16:33:08+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-27T16:10:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `undici` to `8.11.2` or later, then reinstall and redeploy\n- Until upgraded, set `allowH2: false` in the WebSocket client options to disable HTTP/2 for WebSocket connections\n- Until upgraded, avoid opening WebSocket connections to servers you do not trust","reach":"internet","title":"undici: failed HTTP/2 WebSocket handshake lets a server crash clients","impact":"medium","summary":"undici's experimental WebSocket client, on by default over HTTP/2, leaves a stream without an error listener when a server returns a malformed upgrade response. When the server then drops the connection, the unhandled error exits the Node.js process. A remote, unauthenticated server can crash any client that opens a WebSocket to it.","category":"package","nicknames":[],"who_cares":["node","undici","websocket","http2"],"confidence":0.85,"needs_auth":"no","worst_case":"Remote server crashes the Node.js client process with denial of service","analyst_note":"","how_to_check":"- Run `node -e \"console.log(require('undici/package.json').version)\"` in the project and check whether it prints `8.11.0` or `8.11.1`\n- Run `npm ls undici` to find transitive copies pulled in by other packages\n- Search lockfiles for `undici` entries resolving to `8.11.0` or `8.11.1`","needs_analyst":false,"not_affected_if":["default-config-off","no-websocket-use","pinned-below-8.11.0"],"who_is_affected":"Applications running undici 8.11.0 or 8.11.1 that open WebSocket connections, since HTTP/2 WebSocket support is enabled by default. The exposure is strongest for clients that connect to servers outside the team's control. Services that only use undici for plain HTTP requests, or that pin an older major line, are not affected by this WebSocket path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":3618,"output_tokens":681,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109855':15A,23A '-2026':14A,22A '-248':28B '-754':30B '3rwp':20A '7v2v':19A '8.11.0':194C,204C '8.11.1':196C '8.11.2':208C 'abort':127C,132C 'affect':198C 'allowh2':97C,211C 'alreadi':142C 'answer':115C 'avoid':220C 'client':3A,40B,82B,92C,184C 'clienthttp2stream':148C 'complet':144C 'connect':67B,105C,162C,218C,223C 'crash':80B,99C 'cve':13A,21A 'cwe':27B,29B 'default':43B,95C 'deni':180C 'denial':6A 'destroy':160C 'disabl':214C 'drop':65B 'emit':166C 'enabl':93C 'error':51B,70B,154C,169C 'exit':71B,173C 'experiment':38B,90C 'fail':10A,123C 'fals':212C 'ghsa':17A 'ghsa-qq8j-7v2v-3rwp':16A 'handshak':12A,124C 'http/2':11A,45B,111C,192C,215C 'http2':31B 'impact':87C 'introduc':202C 'leav':46B 'left':150C 'listen':52B,155C 'malform':58B 'malici':108C 'mark':143C 'no-op':135C 'node':32B 'node.js':73B,101C 'nodejs':25A 'op':137C 'open':84B,151C,186C,221C 'orphan':164C 'packag':33B 'patch':205C 'process':74B,102C,172C 'qq8j':18A 'regress':200C 'remot':76B,175C 'request':129C,140C 'respons':60B,121C 'return':56B 'server':55B,63B,78B,109C,114C,158C,177C,226C 'servic':8A,181C 'set':210C 'stream':48B,165C 'therefor':179C 'true':98C 'unauthent':77B,176C 'under':147C 'undici':1A,24A,26A,34B,36B,88C,126C,193C 'unhandl':69B,168C 'untrust':225C 'upgrad':59B,118C,206C,228C 'valid':125C 'via':9A,96C 'vulner':4A 'websocket':2A,35B,39B,86B,91C,117C,188C,217C,222C 'without':49B 'workaround':209C","nicknames":[],"mitigations":[],"who_affected":"Applications running undici 8.11.0 or 8.11.1 that open WebSocket connections, since HTTP/2 WebSocket support is enabled by default. The exposure is strongest for clients that connect to servers outside the team's control. Services that only use undici for plain HTTP requests, or that pin an older major line, are not affected by this WebSocket path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qq8j-7v2v-3rwp","url":"https://github.com/advisories/GHSA-qq8j-7v2v-3rwp","severity":"high","published_at":"2026-10-27T16:09:45+00:00","modified_at":"2026-10-27T16:09:47+00:00","first_seen_at":"2026-10-27T16:10:07+00:00","fetched_at":"2026-10-27T16:10:07+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109855","severity":null,"published_at":"2026-10-15T09:17:16+00:00","modified_at":"2026-10-19T20:46:49+00:00","first_seen_at":"2026-10-27T16:33:08+00:00","fetched_at":"2026-10-27T16:33:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}