Patch Forecast
Amber warning
Patch this week.

CVE-2026-109855

undici is an HTTP client library for Node.js

Risk score
64/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.3%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream…
Affected
Undici before 8.11.2
Fix
Upgrade Undici to 8.11.2 or later.
Exploitation
No known exploitation

Story map

Story map: UndiciTHE FLAWSTHE FIXCVE-2026-109855Undici is an HTTP client libraryfor Node.jsCVSS 7.5 · EPSS 0%CVE-2026-109383Undici is an HTTP client libraryfor Node.jsCVSS 9.1 · EPSS 0%CVE-2026-109829Undici is an HTTP client libraryfor Node.jsCVSS 9.1 · EPSS 0%CVE-2026-109932Undici is an HTTP client libraryfor Node.jsCVSS 7.5 · EPSS 0%Upgrade Undici8.11.2or later on your release lineWho is exposedUndiciAMBER · PATCH THIS WEEKUndiciundici is an HTTP client libraryfor Node.js. In versions 4.0.0through 6.29.0, 7.0.0 through7.30.0, and 8.0.0 through 8.12.1,its Agent dispatcher passes itsconstructor options through aJSON-based deep clone before…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-248 (CWE-248)63 other warnings in 30 days →Same productEarlier Undici warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Undici: Amber, patch this week. undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-suppl…

The flaws

  • CVE-2026-109855: Undici is an HTTP client library for Node.js (CVSS 7.5 · EPSS 0%)
  • CVE-2026-109383: Undici is an HTTP client library for Node.js (CVSS 9.1 · EPSS 0%)
  • CVE-2026-109829: Undici is an HTTP client library for Node.js (CVSS 9.1 · EPSS 0%)
  • CVE-2026-109932: Undici is an HTTP client library for Node.js (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Undici: 8.11.2 or later on your release line

Who is exposed: Undici

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: node.js

References

Original description

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

Last activity 15 Oct 2026. Patch Forecast updates every hour.