CVE-2026-109855: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Published Oct 15, 2026

Updated

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

Affected Software

1 affected component

npm/undici=8.11.0, =8.11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade undici to a version that resolves this vulnerability.
Fixed in 8.11.2
Configuration
Set allowH2 to false to disable HTTP/2 for WebSocket connections.
undici WebSocket client allowH2 = false
Compensating control
Avoid opening WebSocket connections to untrusted servers.

Event History

Oct 15, 2026

CVE Published

via MITRE·08:12 AM

Data Sourced

via MITRE·08:12 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using undici 8.11.0 or 8.11.1 are affected when their experimental WebSocket client opens connections with HTTP/2 allowed. The experimental WebSocket client is enabled by default when HTTP/2 is allowed.

What must an attacker do to trigger the denial of service?

An unauthenticated attacker needs to operate or control a server that the client opens a WebSocket connection to over HTTP/2. After causing a failed handshake, the server can destroy the connection, leading to an unhandled error that exits the Node.js process.

What can be done if upgrading is not immediately possible?

Set allowH2 to false to disable HTTP/2 for WebSocket connections. Avoid opening WebSocket connections to untrusted servers until the upgrade can be applied.

How is the issue remediated?

Upgrade undici to version 8.11.2 or later.