CVE-2026-109855

The undici HTTP client library for Node.js (versions 8.11.0 and 8.11.1 ) contains a vulnerability in its experimental WebSocket client . When HTTP/2 is enabled, a failed WebSocket handshake causes the request to be marked as completed prematurely, making the abort a no-op and leaving the underlyi...