undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Impact undici's experimental WebSocket client enabled by default via allowH2: true crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort ...

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake vulnerability discovered by ? in WordPress npm undici versions = 8.11.0, 8.11.2...

CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-109855

The undici HTTP client library for Node.js (versions 8.11.0 and 8.11.1 ) contains a vulnerability in its experimental WebSocket client . When HTTP/2 is enabled, a failed WebSocket handshake causes the request to be marked as completed prematurely, making the abort a no-op and leaving the underlyi...