undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

影響: npm:undici >= 8.11.0, < 8.11.2 → 8.11.2

undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an…

GitHub Advisory Databaseで読む

2026/10/28 01:09、GitHub Advisory Databaseが「undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-109855。