## undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-109855
- 公開日時: 2026-10-27T16:09:45.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-qq8j-7v2v-3rwp)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-qq8j-7v2v-3rwp

影響: npm:undici >= 8.11.0, < 8.11.2 → 8.11.2
undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an…