undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.
Weakness
An exception is thrown from a function, but it is not caught.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Undici | Nodejs | 8.11.0 (including) | 8.11.2 (excluding) |
| Red Hat Hardened Images | RedHat | grafana12-4-main-12.4.12-0.4.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-11.20.0-1.26.11.1.0.3.hum1 | * |
| Red Hat Hardened Images | RedHat | nodejs26-main-26.11.1-0.3.hum1 | * |