CVE-2026-109855: undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is…

PriorityP343high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.28%

19.3th percentile

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

Affected

47 ranges· showing 25

Vendor	Product	Version range	Fixed in
ansible-automation-platform	automation-portal	—	—
ansible-automation-platform	bootc-automation-portal-rhel9	—	—
cryostat	cryostat-openshift-console-plugin-rhel9	—	—
devspaces	code-rhel9	—	—
devspaces	dashboard-rhel9	—	—
devspaces	openvsx-rhel9	—	—
devspaces	pluginregistry-rhel9	—	—
exploit-intelligence	vulnerability-analysis-rhel9	—	—
external-secrets-management	console-plugin-rhel9	—	—
grafana	grafana	—	—
nodejs	undici	>= 8.11.0 < 8.11.2	8.11.2
nodejs_22	nodejs	—	—
nodejs_24	nodejs	—	—
nodejs_26	nodejs	—	—
odf4	mcg-core-rhel9	—	—
odf4	ocs-client-console-rhel9	—	—
odf4	odf-console-rhel9	—	—
odf4	odf-multicluster-console-rhel9	—	—
openshift4	ose-monitoring-plugin-rhel9	—	—
rhdh	red-hat-developer-hub-backstage-plugin-lightspeed-backend	—	—
rhdh	red-hat-developer-hub-backstage-plugin-orchestrator-backend	—	—
rhdh	red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki	—	—
rhdh	red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator	—	—
rhdh	rhdh-hub-rhel9	—	—
rhoai	odh-core-bff-rhel9	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.