Zero Radar
← feed
HighVulnerabilityCVE-2026-109855updated 27 Oct 2026, 16:11 UTC

undici WebSocket client can crash Node.js when connecting to a malicious server

A Node.js app using this library can be made to crash by a hostile server it connects to over a WebSocket. Updating the library stops the crash.

Fixed in 8.11.2Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes8.11.2 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Malicious serverHosts a hostile WebSocket endpoint over HTTP/2
  2. 2Client connectsApp opens WebSocket via undici 8.11.0/8.11.1
  3. 3Failed handshakeServer sends invalid upgrade response; abort is a no-op
  4. 4Stream left openStream has no error listener
  5. 5Process exitsServer destroys connection; unhandled error crashes Node.js
  6. ResultClient Node.js process crashes

What happened

In undici 8.11.0 and 8.11.1, the experimental WebSocket client over HTTP/2 leaves an underlying stream open without an error listener after a failed handshake; when the server destroys the connection, the unhandled error exits the Node.js process.

Why it is dangerous: A remote, unauthenticated server can crash any client process that opens a WebSocket to it over HTTP/2, causing denial of service.

Are you affected?

You are affected if you use undici 8.11.0 or 8.11.1 in Node.js and open WebSocket connections (HTTP/2 enabled by default via allowH2: true) to servers you do not fully trust.

Package / productAffected versionsFixed in
undici · npm>= 8.11.0, < 8.11.28.11.2

What to do

  1. Upgrade undici to 8.11.2 or later
  2. Until upgraded, set allowH2: false to disable HTTP/2 for WebSocket connections
  3. Avoid opening WebSocket connections to untrusted servers until the update is applied

Timeline

  1. 27 Oct 2026, 16:09 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:09 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 16:11 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-109855 · GHSA-qq8j-7v2v-3rwp
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 16:09 UTC
On Zero Radar
27 Oct 2026, 16:11 UTC (1 min after disclosure)
Last change
27 Oct 2026, 16:11 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

undici WebSocket client can crash Node.js when connecting to a malicious server · Zero Radar