Skip to content
Fencer Intel
high 7.5

CVE-2026-109855 json

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

published 25d ago modified 13d ago also GHSA-qq8j-7v2v-3rwp , EUVD-2026-101959

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

Patch / fix

  • npm undici 8.11.2
  • undici undici 8.11.2
  • node-undici Debian 14 8.12.2+dfsg+~cs3.2.3-1

debian advisories DEBIAN-CVE-2026-109855

  • nodejs26 hummingbird 1 26.11.1-0.3.hum1
  • nodejs26-bin hummingbird 1 26.11.1-0.3.hum1
  • nodejs26-npm hummingbird 1 11.20.0-1.26.11.1.0.3.hum1
  • nodejs26-libs hummingbird 1 26.11.1-0.3.hum1
  • nodejs26-npm-bin hummingbird 1 26.11.1-0.3.hum1
  • nodejs26-full-i18n hummingbird 1 26.11.1-0.3.hum1
  • grafana12.4 hummingbird 1 12.4.12-0.4.hum1

red hat advisories RHSA-2026:83198RHSA-2026:76677

Is CVE-2026-109855 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-109855 updated cvss 6.5

undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake

  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9 Red Hat AMQ Broker 7 amq-broker-maven-repository.zip 7.14.1.CR3
    affected: no fix available
  • Red Hat Hardened Images nodejs25 25.9.0-1.7.hum1
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9
    affected: no fix available
  • Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/monitoring-console-plugin-rhel9 1793663585, cluster-observability-operator/monitoring-console-plugin-rhel9 1793827684, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1793660952, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1793824934, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1793662327, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1793827768, +10 more
    fixed: vendor fix RHSA-2026:95591
  • Red Hat Hardened Images nodejs26 26.11.1-0.3.hum1, grafana12.4 12.4.12-0.4.hum1, nodejs26-bin 26.11.1-0.3.hum1, nodejs26-libs 26.11.1-0.3.hum1, nodejs26-npm-bin 26.11.1-0.3.hum1, nodejs26-full-i18n 26.11.1-0.3.hum1, +1 more
    fixed: vendor fix RHSA-2026:76677
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1793661985, cluster-observability-operator/perses-rhel9 1793825744, cluster-observability-operator/thanos-rhel9 1793660568, cluster-observability-operator/thanos-rhel9 1793821585, cluster-observability-operator/korrel8r-rhel9 1793661297, cluster-observability-operator/korrel8r-rhel9 1793822079, +28 more
    not affected: vulnerable code not present
  • Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9
    not affected: component not present
show 1 more
  • Red Hat AMQ Broker 7 amq-broker-bin.zip 7.14.1.CR3 Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.15-1.el9ap Red Hat Build of Podman Desktop rh-podman-desktop a4ea1f988eb28bc86ab3516bba3a4973b252a17e Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki, rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n
    +8 more products
    Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10, nodejs26 26.1.0-1.el10, nodejs22 22.23.2-3.el10_2, nodejs24 24.21.0-1.el10_2 Red Hat Hardened Images nodejs24 24.21.0-1.el10_2 Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more Red Hat OpenShift Container Platform 4 wasmedge, wasmedge-rt, openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/odf-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9 Red Hat Trusted Artifact Signer rhtas/rhtas-console-ui-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal, ansible-automation-platform/bootc-automation-portal-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
25d ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm undici
>=8.11.0, <8.11.2
8.11.2

Affected products

  • undici undici

Classification

Weakness
  • CWE-248 Uncaught Exception
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.