Denial of Service Vulnerability in undici Library for Node.js

CVE-2026-109855

What is CVE-2026-109855?

The undici HTTP client library for Node.js, specifically versions 8.11.0 and 8.11.1, suffers from a denial of service vulnerability related to its experimental WebSocket client functionality. When HTTP/2 is enabled, the library mishandles failed WebSocket handshakes, leaving associated HTTP/2 streams open without error listeners. This can cause the Node.js process to exit if a malicious server exploits this by destroying the connection, leading to application downtime. Users are encouraged to upgrade to version 8.11.2 or higher to mitigate this vulnerability. Alternatively, disabling HTTP/2 for WebSocket connections is a temporary workaround until the upgrade is performed.

References