CVE-2026-109855
Description
A flaw was found in undici. A malicious remote server can cause a Denial of Service (DoS) by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream open without an error handler. When the remote server subsequently terminates the connection, an unhandled error is raised, causing the application process to crash.
Statement
This vulnerability is rated as Important impact because an unauthenticated remote endpoint can trigger an unhandled exception that terminates the entire Node.js application process, resulting in a complete denial of service. The risk primarily impacts client applications or services configured to open outbound WebSocket sessions over HTTP/2 to untrusted or external servers. In typical Red Hat environments, many bundled container services connect exclusively to controlled internal infrastructure, substantially reducing the likelihood of encountering an adversarial endpoint.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
