HighGHSA-qq8j-7v2v-3rwpCVE-2026-109855

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Published 27 Oct 2026 · Updated 27 Oct 2026

Affected package

Affected: >=8.11.0 <8.11.2
Fixed in: 8.11.2

Update to the fixed version for your release line, for example:npm install undici@8.11.2

Details

Impact

undici's experimental WebSocket client (enabled by default via allowH2: true) crashes the Node.js process when it connects to a malicious server over HTTP/2. If the server answers the WebSocket upgrade with a response that fails handshake validation, undici aborts the request, but the abort is a no-op because the request is already marked completed, so the underlying ClientHttp2Stream is left open with no error listener. When the server then destroys the connection, the orphaned stream emits an unhandled error and the process exits. A remote, unauthenticated server can therefore deny service to any client that opens a WebSocket to it over HTTP/2. undici 8.11.0 and 8.11.1 are affected; the regression was introduced in 8.11.0.

Patches

Upgrade to 8.11.2.

Workarounds

Set allowH2: false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers, until upgrading.

Is GHSA-qq8j-7v2v-3rwp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.