CVE-2026-109855 undici CVE debrief

Who should care

Node.js developers and administrators who use the undici library should assess their exposure and upgrade to version 8.11.2 or later. This includes teams responsible for maintaining Node.js applications that utilize the undici library for WebSocket connections over HTTP/2. Security teams should prioritize remediation efforts for affected systems to prevent potential denial-of-service attacks. IT administrators should ensure that updates are applied to all

Why it matters

CVE-2026-109855 is a high-severity vulnerability in the undici HTTP client library for Node.js that allows remote denial of service via WebSocket over HTTP/2. Node.js developers and administrators should assess their exposure and upgrade to version 8.11.2 or later.

• Denial of service via remote WebSocket connection over HTTP/2
• Potential for Node.js process exit
• Need for verification of affected versions and exposure
• Remediation priority for undici users

Technical summary

The undici HTTP client library for Node.js has a vulnerability in its experimental WebSocket client. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. The vulnerability is caused by the experimental WebSocket client in undici mishandling a failed WebSocket handshake over HTTP/2. The request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. This issue can be mitigated by upgrading to undici 8.11.2 or later, or by setting allowH2 to false to disable HTTP/2 for WebSocket connections.

Defensive priority

Upgrade to undici 8.11.2 or later, or set allowH2 to false to disable HTTP/2 for WebSocket connections.

Recommended defensive actions

• Upgrade to undici 8.11.2 or later
• Set allowH2 to false to disable HTTP/2 for WebSocket connections
• Avoid opening WebSocket connections to untrusted servers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is caused by the experimental WebSocket client in undici mishandling a failed WebSocket handshake over HTTP/2. The request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.