CVE-2026-109855: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
undici’s experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.
References
- cna.openjsf.org/security-advisories.html
- github.com/advisories/GHSA-qq8j-7v2v-3rwp
- github.com/nodejs/undici/commit/dd28c5c55f4a25f7c441fd4365b1191f96c3b8bf
- github.com/nodejs/undici/pull/5873
- github.com/nodejs/undici/releases/tag/v8.11.2
- github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
- nvd.nist.gov/vuln/detail/CVE-2026-109855
Code Behaviors & Features
Detect and mitigate CVE-2026-109855 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →