{"id":"ghsa-ghsa-qq8j-7v2v-3rwp","seq":1708772,"kind":"advisory","title":"undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake","url":"https://github.com/advisories/GHSA-qq8j-7v2v-3rwp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qq8j-7v2v-3rwp","summary":"影響: npm:undici >= 8.11.0, < 8.11.2 → 8.11.2\nundici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-109855"],"tags":["GHSA-qq8j-7v2v-3rwp","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:09:45.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}