CVE-2026-109855: Node.js Undici WebSocket DOS Vulnerability

CVE-2026-109855 Overview

CVE-2026-109855 is a denial-of-service vulnerability in undici, an HTTP client library for Node.js. Versions 8.11.0 and 8.11.1 mishandle failed WebSocket handshakes performed over HTTP/2 when the experimental WebSocket client has allowH2 enabled. A malicious remote server can destroy the connection, triggering an unhandled error on an orphaned HTTP/2 stream and crashing the Node.js process. The flaw is tracked under [CWE-248: Uncaught Exception] and requires no authentication or user interaction. Maintainers resolved the issue in undici 8.11.2.

Critical Impact
A remote, unauthenticated server can crash any Node.js client that opens a WebSocket to it over HTTP/2, producing a process-level denial of service.

Affected Products

nodejs undici 8.11.0
nodejs undici 8.11.1
Node.js applications using undici WebSocket client with allowH2: true

Discovery Timeline

2026-10-15 - CVE-2026-109855 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-109855

Vulnerability Analysis

The defect lives in the experimental WebSocket client shipped with undici. When allowH2 is set (the default when HTTP/2 is permitted), the client can upgrade WebSocket traffic over an HTTP/2 stream. If the WebSocket handshake fails, the request object is already marked as completed. The subsequent abort therefore becomes a no-op, and the underlying HTTP/2 stream remains open without an attached error listener. When the remote peer destroys the connection, the orphaned stream emits an error with no handler, and Node.js terminates the process. The result is a reliable crash of the client application driven entirely by the server side.

Root Cause

The root cause is an uncaught exception path [CWE-248]. The WebSocket client fails to transition stream cleanup correctly after a failed handshake over HTTP/2, leaving a dangling stream object with no error handler bound.

Attack Vector

Exploitation is network-based and requires only that a Node.js client initiate a WebSocket connection to an attacker-controlled server over HTTP/2. The malicious server returns a failed handshake response, waits for the client to leak the HTTP/2 stream, then destroys the connection. The emitted error has no listener, so the Node.js runtime exits. No credentials or user interaction are required.

No verified public proof-of-concept is available at this time. Refer to the GitHub Security Advisory GHSA-qq8j-7v2v-3rwp for maintainer details.

Detection Methods for CVE-2026-109855

Indicators of Compromise

Unexpected Node.js process exits shortly after initiating outbound WebSocket connections.
Application logs showing ERR_HTTP2_STREAM_ERROR or unhandled stream error events immediately before process termination.
Outbound HTTP/2 connections to untrusted hosts followed by abrupt TCP RST or GOAWAY frames.

Detection Strategies

Inventory running services for undici versions 8.11.0 and 8.11.1 using software composition analysis against package-lock.json and node_modules.
Correlate process-exit telemetry with recent outbound WebSocket activity to identify crash patterns consistent with this flaw.
Flag Node.js services configured with allowH2: true on their WebSocket client as elevated risk until patched.

Monitoring Recommendations

Monitor service restart counts and systemd or container orchestrator crash loops on Node.js workloads.
Capture outbound HTTP/2 connection metadata at the network edge to spot repeated handshake failures from the same remote peers.
Alert on dependency drift that reintroduces vulnerable undici versions during CI/CD builds.

How to Mitigate CVE-2026-109855

Immediate Actions Required

Upgrade undici to version 8.11.2 or later across all Node.js applications and container images.
Audit transitive dependencies, since many Node.js HTTP libraries bundle undici indirectly.
Restart affected services after patching to ensure the vulnerable code is unloaded from memory.

Patch Information

The maintainers fixed the issue in undici 8.11.2. Review the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-qq8j-7v2v-3rwp for upstream release notes and patch commits.

Workarounds

Set allowH2 to false on the WebSocket client to disable HTTP/2 negotiation for WebSocket connections.
Restrict WebSocket connections to trusted, allow-listed server endpoints only.
Run affected Node.js services under a supervisor that enforces strict restart policies to limit downtime while patches propagate.

bash

# Upgrade undici to the fixed release
npm install undici@^8.11.2

# Verify the installed version
npm ls undici

# Workaround: disable HTTP/2 for the WebSocket client
# In application code:
#   new WebSocket(url, { allowH2: false })