CVE-2026-109855

A flaw was found in undici. A malicious remote server can cause a Denial of Service (DoS) by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream open without an error handler. When the remote server subsequently terminates the connection, an unhandled error is raised, causing the application process to crash.

This vulnerability is rated as Important impact because an unauthenticated remote endpoint can trigger an unhandled exception that terminates the entire Node.js application process, resulting in a complete denial of service. The risk primarily impacts client applications or services configured to open outbound WebSocket sessions over HTTP/2 to untrusted or external servers. In typical Red Hat environments, many bundled container services connect exclusively to controlled internal infrastructure, substantially reducing the likelihood of encountering an adversarial endpoint.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.