{"id":"EUVD-2026-101959","enisaUuid":"88446f20-7475-36bc-a39b-867155a763cb","description":"undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.","datePublished":"Oct 15, 2026, 8:12:51 AM","dateUpdated":"Oct 15, 2026, 2:22:28 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp\nhttps://cna.openjsf.org/security-advisories.html\n","aliases":"CVE-2026-109855\nGHSA-qq8j-7v2v-3rwp\n","assigner":"openjs","epss":0.28,"enisaIdProduct":[{"id":"e9e3e01a-b732-38ce-8b5d-da9d0238b050","product":{"name":"undici","vendor":{"name":"undici"}},"product_version":"8.11.0 \u003c8.11.2"}],"enisaIdVendor":[{"id":"2bce5b63-ba7d-3129-b063-9a21045ef0bc","vendor":{"name":"undici"}}],"enisaIdVulnerability":[{"id":"7d78a0ea-add8-36a3-990b-753f90b5b870","vulnerability":{"id":"GHSA-qq8j-7v2v-3rwp","description":"undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake","datePublished":"Oct 27, 2026, 4:09:45 PM","dateUpdated":"Oct 27, 2026, 4:09:45 PM","baseScore":0.0,"references":"https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109855\nhttps://github.com/nodejs/undici/pull/5873\nhttps://github.com/nodejs/undici/commit/dd28c5c55f4a25f7c441fd4365b1191f96c3b8bf\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/nodejs/undici\nhttps://github.com/nodejs/undici/releases/tag/v8.11.2\n","enisa_id":"EUVD-2026-101959\n","aliases":"CVE-2026-109855\nGHSA-qq8j-7v2v-3rwp\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 11:01:28 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b7349dcc-cb8b-3d58-b491-5f8f3e25a31d","vulnerability":{"id":"CVE-2026-109855","description":"undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.","datePublished":"Oct 15, 2026, 8:12:51 AM","dateUpdated":"Oct 15, 2026, 2:22:28 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp\nhttps://cna.openjsf.org/security-advisories.html\n","enisa_id":"EUVD-2026-101959\n","assigner":"openjs","epss":0.28,"dataProcessed":"Oct 29, 2026, 7:16:55 AM","vulnerabilityProduct":[{"id":"f1b49e6e-7093-3d60-a59d-dd45be968056","product":{"name":"undici","vendor":{"name":"undici"}},"product_version":"8.11.0 \u003c8.11.2"}],"vulnerabilityVendor":[{"id":"9187dd0a-2057-34d7-b46b-fb55644f43eb","vendor":{"name":"undici"}}]}}],"enisaIdAdvisory":[{"id":"2ca34b8c-30c7-3114-8ace-6622629c1860","advisory":{"id":"RHSA-2026:76677","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 6, 2026, 8:26:00 AM","dateUpdated":"Oct 27, 2026, 4:24:52 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76677\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76677.json\n","aliases":"CVE-2024-24786\nCVE-2026-56851\nCVE-2026-61801\nCVE-2026-95502\nCVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-101899\nCVE-2026-109855\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"335287a7-ced4-3080-b1ad-2e6235bafb6e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"51b55ba2-f5d3-34ff-b412-1563b7f7b0b4","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"63f37ffb-218f-312e-b209-a77eda41aef4","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"f76f70aa-ccdd-3070-90c3-fd71da797c14","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"865c761c-bd4c-3998-9a7d-a88c795abb8f","advisory":{"id":"RHSA-2026:83198","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 14, 2026, 10:13:50 PM","dateUpdated":"Oct 20, 2026, 6:09:54 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:83198\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83198.json\n","aliases":"CVE-2026-109855\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"08b2a2c7-7a3f-38fb-a86d-b08f49c2e47a","product":{"name":"v8-14.6-devel-0:14.6.202.34-1.26.11.1.0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"10b62e9b-f2ae-3da4-a0db-ae680441ecd1","product":{"name":"nodejs26-libs-0:26.11.1-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"26d8fc7c-d963-3639-ae40-81441a0a744e","product":{"name":"nodejs26-0:26.11.1-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"301fb61c-8a3f-3d23-9bfd-c06957f851dc","product":{"name":"nodejs26-0:26.11.1-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"35c26fbe-63b7-3e8c-8e0e-d4b7d28c20dc","product":{"name":"nodejs26-devel-0:26.11.1-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"3cdc176c-0890-30ab-a643-f14e64d4fd09","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"542bf3da-5aed-37ad-899d-c17abcb89e3a","product":{"name":"nodejs26-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-x86_64-rpms","vendor":{"name":"Red Hat"}}},{"id":"546839dd-7c08-3c8d-8e6a-b2861ddf4253","product":{"name":"nodejs26-libs-0:26.11.1-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"5d90df1d-ba7b-35f9-aa67-5508053a7748","product":{"name":"nodejs26-full-i18n-0:26.11.1-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"5e34e296-49de-3f45-bff5-edbd2a17aae5","product":{"name":"nodejs26-0:26.11.1-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"6869eab3-d152-356c-93eb-7bc13a1c674a","product":{"name":"nodejs26-docs-0:26.11.1-0.3.hum1@noarch@public-hummingbird-x86_64-rpms","vendor":{"name":"Red Hat"}}},{"id":"6cce29fd-9ac4-3aef-801b-4c8eccb85c44","product":{"name":"nodejs26-npm-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-x86_64-rpms","vendor":{"name":"Red Hat"}}},{"id":"701ce92a-4f46-3d93-a30d-8bd3ff6773e5","product":{"name":"nodejs26-npm-0:11.20.0-1.26.11.1.0.3.hum1@noarch@public-hummingbird-x86_64-rpms","vendor":{"name":"Red Hat"}}},{"id":"7a8d2ebd-15cb-3c56-b68c-267dc26afba6","product":{"name":"nodejs26-devel-0:26.11.1-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"7cd292fb-fa3d-3920-87da-739c877670d2","product":{"name":"nodejs26-docs-0:26.11.1-0.3.hum1@noarch@public-hummingbird-aarch64-rpms","vendor":{"name":"Red Hat"}}},{"id":"7e442549-1c56-34c7-8739-6a6206897e64","product":{"name":"v8-14.6-devel-0:14.6.202.34-1.26.11.1.0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"8d6e5b4f-1080-375d-af2a-48454d092e6e","product":{"name":"nodejs26-0:26.11.1-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"9d58dfd7-99ca-3eb8-bbe8-ce53688a2989","product":{"name":"nodejs26-npm-0:11.20.0-1.26.11.1.0.3.hum1@noarch@public-hummingbird-aarch64-rpms","vendor":{"name":"Red Hat"}}},{"id":"a2d8d989-873f-3266-8276-0054d20ced6f","product":{"name":"nodejs26-full-i18n-0:26.11.1-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a7715ae0-346c-3fbe-b8d7-b5777570c36b","product":{"name":"nodejs26-devel-0:26.11.1-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"aaa23c62-ae1b-3568-8c12-78e3c27cb49a","product":{"name":"nodejs26-full-i18n-0:26.11.1-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d73a4f38-6fe3-3747-93c2-112124b7b0ca","product":{"name":"nodejs26-libs-0:26.11.1-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"db30f410-3411-32a0-a8b8-79adacfebdc9","product":{"name":"nodejs26-npm-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-s390x-rpms","vendor":{"name":"Red Hat"}}},{"id":"dbf8b20d-5a1e-3096-9894-fb313888d147","product":{"name":"nodejs26-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-aarch64-rpms","vendor":{"name":"Red Hat"}}},{"id":"e02ad6e2-7aef-35ec-8d16-252f4d06b8ba","product":{"name":"v8-14.6-devel-0:14.6.202.34-1.26.11.1.0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"e8492e68-7547-33bb-9485-2a5f3d0d2cd8","product":{"name":"nodejs26-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-s390x-rpms","vendor":{"name":"Red Hat"}}},{"id":"e877472e-ebf7-3b60-80ca-eff5665a1c78","product":{"name":"nodejs26-docs-0:26.11.1-0.3.hum1@noarch@public-hummingbird-s390x-rpms","vendor":{"name":"Red Hat"}}},{"id":"eb2fc5b9-d0dd-3ea0-9403-0dd419a57a0f","product":{"name":"nodejs26-npm-0:11.20.0-1.26.11.1.0.3.hum1@noarch@public-hummingbird-s390x-rpms","vendor":{"name":"Red Hat"}}},{"id":"f4c413aa-9ec2-382b-9357-6851646309f9","product":{"name":"nodejs26-npm-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-aarch64-rpms","vendor":{"name":"Red Hat"}}}]}}]}