GHSA-qq8j-7v2v-3rwp

Source

https://github.com/advisories/GHSA-qq8j-7v2v-3rwp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qq8j-7v2v-3rwp/GHSA-qq8j-7v2v-3rwp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qq8j-7v2v-3rwp

Aliases

CVE-2026-109855

Published

2026-10-27T16:09:45Z

Modified

2026-10-27T16:15:05Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Details

Impact

undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.

Patches

Upgrade to 8.11.2.

Workarounds

Set allowH2: false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers, until upgrading.

Database specific

{
    "cwe_ids":  [
        "CWE-248",
        "CWE-754"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T16:09:45Z",
    "nvd_published_at":  "2026-10-15T09:17:16Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / undici

Package

Name: undici; View open source insights on deps.dev
Purl: pkg:npm/undici

Affected ranges

Type: SEMVER
Events: Introduced

8.11.0

Fixed

8.11.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qq8j-7v2v-3rwp/GHSA-qq8j-7v2v-3rwp.json"