undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
影響: npm:undici >= 8.11.0, < 8.11.2 → 8.11.2
undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an…
Read on GitHub Advisory Database
| CVE | CVE-2026-109855 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/28/2026, 06:03 AM |
| Data | Markdown JSON |
On 10/28/2026, 01:09 AM, GitHub Advisory Database published "undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-109855.