CVE-2026-109855

Name of the Vulnerable Software and Affected Versions undici versions 8.11.0 through 8.11.1

Description The experimental WebSocket client in this Node.js HTTP client library mishandles failed WebSocket handshakes over HTTP/2. Because the request is marked as completed, the abort operation is ignored, leaving the underlying HTTP/2 stream open without an error listener. A remote, unauthenticated server can trigger a denial of service by destroying the connection, causing the orphaned stream to emit an unhandled error that crashes the Node.js process.

Recommendations Update to version 8.11.2 or later. Set allowH2 to false to disable HTTP/2 for WebSocket connections. Avoid opening WebSocket connections to untrusted servers.