undici CVE-2026-109855

Requires the victim Node.js application to use undici 8.11.0 or 8.11.1 AND to open a WebSocket connection, over HTTP/2, to a server the attacker controls or can manipulate. The experimental WebSocket client is enabled by default whenever HTTP/2 is allowed (allowH2 true is the default), so no special opt-in is needed on the client. Limiting factors that reduce real-world risk: the client must itself initiate the outbound WebSocket to an untrusted/attacker-influenced server (not a server-side listening flaw), only two undici releases are vulnerable, and the documented workarounds - setting allowH2 to false or never opening WebSockets to untrusted servers - fully mitigate it without upgrading.

This is a genuine but conditional availability risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) correctly captures a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - purely a denial of service (CWE-248, uncaught exception crashing the Node.js process). The critical nuance the base score hides is directionality: this is a CLIENT-side vulnerability where the attacker is a malicious SERVER. Exploitation is only possible if the victim application itself opens a WebSocket connection to an attacker-controlled or untrusted endpoint over HTTP/2, so 'AV:N / PR:N' is technically accurate but the realistic attack surface is narrower than the score implies. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The exposure is further bounded to exactly two releases (undici 8.11.0 and 8.11.1). Net assessment: a real, easily-triggered crash worth prompt patching for services that make outbound WebSocket connections to third parties, but not a mass-exploitation or spray-and-pray priority given its client-initiated nature and narrow affected-version window.

An attacker stands up a malicious server (or compromises/MITMs one a victim client already connects to) that speaks HTTP/2 and WebSockets. When a vulnerable undici-based Node.js client opens a WebSocket to it over HTTP/2, the server deliberately fails the handshake and then destroys the connection, leaving an orphaned HTTP/2 stream with no error listener that emits an unhandled error and terminates the Node.js process. No public exploit code was provided in the input, but the trigger is trivial and requires no authentication from the server side.