EUVD-2026-101959Published
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109855 · Microsoft / collected KEV context
cve-program · CVE-2026-109855
- https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
- https://cna.openjsf.org/security-advisories.html
euvd · EUVD-2026-101959
- https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
- https://cna.openjsf.org/security-advisories.html
nvd · CVE-2026-109855
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
osv · GHSA-qq8j-7v2v-3rwp
- https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
- https://nvd.nist.gov/vuln/detail/CVE-2026-109855
- https://github.com/nodejs/undici/pull/5873
- https://github.com/nodejs/undici/commit/dd28c5c55f4a25f7c441fd4365b1191f96c3b8bf
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v8.11.2
Related operational evidence
Explicit CVE identifiers- undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already … · Advisory content revised · 30 Oct 2026
- undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake · Newly collected advisory · 27 Oct 2026