CVE-2026-109855
Received Received - Intake

WebSocket Connection Crash in Undici Node.js Library

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: openjs

Description
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-109855
EUVD
EUVD-2026-101959

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
undici undici 8.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the undici library in Node.js versions 8.11.0 and 8.11.1. The experimental WebSocket client, enabled by default with HTTP/2 support, mishandles failed WebSocket handshakes. When a server rejects a WebSocket upgrade request over HTTP/2, the request is marked as completed but the underlying HTTP/2 stream remains open without an error listener. If the server later closes the connection, the orphaned stream triggers an unhandled error, crashing the Node.js process. This results in a denial of service for any client connecting to a malicious server.

Detection Guidance

To detect this vulnerability, check if your system uses undici versions 8.11.0 or 8.11.1. Run: npm list undici. If the version is within this range, the system is vulnerable. Monitor Node.js processes for unexpected crashes during WebSocket connections over HTTP/2.

Impact Analysis

If you use Node.js with undici versions 8.11.0 or 8.11.1 and allow HTTP/2 for WebSocket connections, a remote attacker could crash your application by sending a failed WebSocket handshake response. This disrupts service for any users relying on the application. The impact is a complete process exit, leading to downtime until the application is restarted.

Compliance Impact

This vulnerability primarily impacts system availability, which could lead to service disruptions. For GDPR, repeated downtime may affect data processing operations, potentially violating availability requirements under Article 32. For HIPAA, service outages could disrupt access to protected health information, impacting the integrity and availability of systems handling such data. Compliance may require immediate patching to restore service and prevent unauthorized access during outages.

Mitigation Strategies

Upgrade undici to version 8.11.2 or later. Alternatively, disable HTTP/2 for WebSocket connections by setting allowH2 to false in your configuration. Avoid opening WebSocket connections to untrusted servers until upgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart