| Name | CVE-2026-109855 |
| Description | undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| node-undici (PTS) | bookworm | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4 | fixed |
| bookworm (security) | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3 | fixed | |
| trixie | 7.3.0+dfsg1+~cs24.12.11-1 | fixed | |
| forky | 8.10.2+dfsg+~cs3.2.2-1 | vulnerable | |
| sid | 8.12.1+dfsg+~cs3.2.3-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| node-undici | source | bookworm | (not affected) | |||
| node-undici | source | trixie | (not affected) | |||
| node-undici | source | (unstable) | (unfixed) |
[trixie] - node-undici <not-affected> (Vulnerable code not present, only affects 8.x)
[bookworm] - node-undici <not-affected> (Vulnerable code not present, only affects 8.x)
https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp