undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket
    client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over
    HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2
    stream is left open with no error listener. When a malicious server then destroys the connection, the
    orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server
    can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service.
    The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set
    allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to
    untrusted servers. (CVE-2026-109855)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket     client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over     HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2     stream is left open with no error listener. When a malicious server then destroys the connection, the     orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server     can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service.
    The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set     allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to     untrusted servers. (CVE-2026-109855)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477605	SCA: security update for undici (GHSA-qq8j-7v2v-3rwp)	Tenable Cloud Security	SCA Checks	Local	high
477605	SCA: security update for undici (GHSA-qq8j-7v2v-3rwp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
366144	Linux Distros Unpatched Vulnerability : CVE-2026-109855	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-109855

high

Tenable Plugins

high

high

high