---
id: "CVE-2026-109855"
kind: "vulnerability"
aliases: ["CVE-2026-109855", "GHSA-qq8j-7v2v-3rwp"]
title: "undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake"
severity: "high"
cvss: 7.5
epss: 0.00279
exploited: false
status: "open"
category: "package"
products: [{"name": "undici", "fixed": ["8.11.2"], "affected": ">= 8.11.0, < 8.11.2", "ecosystem": "npm"}, {"name": "nodejs undici", "fixed": ["8.11.2"], "affected": ">= 8.11.0, < 8.11.2", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-248", "cwe-754", "http2", "node", "package", "undici", "websocket"]
not_affected_if: ["default-config-off", "no-websocket-use", "pinned-below-8.11.0"]
published_at: "2026-10-15T09:17:16+00:00"
first_seen_at: "2026-10-27T16:10:07+00:00"
updated_at: "2026-10-27T16:33:08+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-qq8j-7v2v-3rwp", "first_seen_at": "2026-10-27T16:10:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109855", "first_seen_at": "2026-10-27T16:33:08+00:00"}]
---

# undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

undici's experimental WebSocket client, on by default over HTTP/2, leaves a stream without an error listener when a server returns a malformed upgrade response. When the server then drops the connection, the unhandled error exits the Node.js process. A remote, unauthenticated server can crash any client that opens a WebSocket to it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:undici affected >= 8.11.0, < 8.11.2 fixed 8.11.2
- vendor:nodejs undici affected >= 8.11.0, < 8.11.2 fixed 8.11.2

## How to check

- Run `node -e "console.log(require('undici/package.json').version)"` in the project and check whether it prints `8.11.0` or `8.11.1`
- Run `npm ls undici` to find transitive copies pulled in by other packages
- Search lockfiles for `undici` entries resolving to `8.11.0` or `8.11.1`

## Fix

- Upgrade `undici` to `8.11.2` or later, then reinstall and redeploy
- Until upgraded, set `allowH2: false` in the WebSocket client options to disable HTTP/2 for WebSocket connections
- Until upgraded, avoid opening WebSocket connections to servers you do not trust

## Timeline

- 2026-10-27T16:10:07+00:00 ghsa https://github.com/advisories/GHSA-qq8j-7v2v-3rwp
- 2026-10-27T16:33:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109855

## From the sources

### Impact

undici's experimental WebSocket client (enabled by default via `allowH2: true`) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying `ClientHttp2Stream` is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled `error` and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.

### Patches

Upgrade to `8.11.2`.

### Workarounds

Set `allowH2: false` to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers, until upgrading.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_