undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

影響: npm:undici >= 8.11.0, < 8.11.2 → 8.11.2

undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an…

在 GitHub Advisory Database 阅读

2026/10/28 01:09，GitHub Advisory Database 发布了“undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-109855。