Vulnpedia
← Search CVEs

CVE-2026-109855

HIGH 7.5

Published 2026-10-15 · Last modified 2026-10-15

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 20th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Undici Nodejs

Products Undici

Weakness (CWE)

  • CWE-248: : Uncaught Exception
  • CWE-754: : Improper Check for Unusual or Exceptional Conditions

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 138 vendor product statements; 106 omitted. Read the full vendor advisory.

  • grafana12.4-0:12.4.12-0.4.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • grafana12.4-0:12.4.12-0.4.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-0:26.11.1-0.3.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-devel-0:26.11.1-0.3.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-devel-0:26.11.1-0.3.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-docs-0:26.11.1-0.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-full-i18n-0:26.11.1-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-libs-0:26.11.1-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-npm-0:11.20.0-1.26.11.1.0.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-npm-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs26-npm-bin-0:26.11.1-0.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/vulnerability-analysis-rhel9@sha256:9e846f56a5aeee9b65fbfee6dd2825113db854aef8dd0d5806df93fdcf2622e7?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • amq-broker-maven-repository.zip as a component of Red Hat AMQ Broker 7 · known affected

    Vendor assessment for this product only.

    pkg:generic/[email protected]

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs25.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • no fix planned: Will not fix
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256:26ac33d2d07f9d51df725604ca695c98597f9bf428f6038bb1d74f9405e8db2d?repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • odf4/ocs-client-console-rhel9 as a component of Red Hat Openshift Data Foundation 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ocs-client-console-rhel9@sha256:7216ce2d92ad684f986c32dced35244e963be67154053b1969a05c93fbd9e966?repository_url=registry.redhat.io/odf4/ocs-client-console-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • odf4/odf-multicluster-console-rhel9 as a component of Red Hat Openshift Data Foundation 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/odf-multicluster-console-rhel9@sha256:6fbfe726dc737df7aff1b7bfd59091f2bc56075b238a40b8ad94343131c49203?repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • devspaces/dashboard-rhel9 as a component of Red Hat OpenShift Dev Spaces · known affected

    Vendor assessment for this product only.

    pkg:oci/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640?repository_url=registry.redhat.io/devspaces/dashboard-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • rhtas/rhtas-console-ui-rhel9 as a component of Red Hat Trusted Artifact Signer · known affected

    Vendor assessment for this product only.

    pkg:oci/rhtas-console-ui-rhel9@sha256:2a0ead6c4378367d5feceea5d494e5565d52738aebd136d35a0e2ae80e7afb14?repository_url=registry.redhat.io/rhtas/rhtas-console-ui-rhel9

    • none available: Affected
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • external-secrets-management/console-plugin-rhel9 as a component of Secrets Management Console for Red Hat OpenShift · known affected

    Vendor assessment for this product only.

    pkg:oci/console-plugin-rhel9@sha256:3ab2dda876e60016c9eddacdf05f501c0a2f66a7a61bef5d33474d5fe8ba7d40?repository_url=registry.redhat.io/external-secrets-management/console-plugin-rhel9

    • no fix planned: Will not fix
    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • v8-14.6-devel-0:14.6.202.34-1.26.11.1.0.3.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator as a component of Red Hat Developer Hub · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:924c4e5e8642438f3099272ff7edd746a66fcec4779aeafb9fd6b3ae0c594f72?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs-npm as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-npm

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-devel?rpmmod=nodejs:22

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs-nodemon (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:22

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs-docs (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:26

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • rhoai/odh-mod-arch-agent-ops-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-agent-ops-rhel9@sha256:bf5e5b308f9f167fe21c2ac0f8f7dd65af47bbd7d0c3396b66fbe62620d853b4?repository_url=registry.redhat.io/rhoai/odh-mod-arch-agent-ops-rhel9

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • wasmedge as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/wasmedge

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00
  • ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9

    Red Hat · CVE-2026-109855 · Updated 2026-10-20T06:08:44+00:00

Known Affected Software Configurations

VendorProductVersion range
NodejsUndici≥ 8.11.0 and < 8.11.2

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS