CVE-2026-109855: 
Grafana vulnerability analysis and mitigation

CVE-2026-109855 is a Denial of Service vulnerability in the undici HTTP client library for Node.js, affecting versions 8.11.0 and 8.11.1. The flaw resides in undici's experimental WebSocket client, which is enabled by default when HTTP/2 is allowed (allowH2: true), and allows a remote, unauthenticated server to crash the Node.js process by exploiting a mishandled failed WebSocket handshake over HTTP/2. The vulnerability was published on October 15, 2026, and is fixed in undici 8.11.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-248 (Uncaught Exception) and CWE-754 (Improper Check for Unusual or Exceptional Conditions). When a WebSocket upgrade over HTTP/2 fails handshake validation, undici attempts to abort the request; however, because the request is already marked as completed, the abort becomes a no-op. This leaves the underlying ClientHttp2Stream open with no error listener attached. When the malicious server subsequently destroys the connection, the orphaned stream emits an unhandled error event, causing the Node.js process to exit. The regression was introduced in undici 8.11.0 and is exploitable by any network-accessible server without requiring authentication or user interaction (GitHub Advisory).

Successful exploitation results in a complete availability impact — the Node.js process crashes, causing a denial of service for any application relying on the affected undici client. There is no confidentiality or integrity impact. Any client application using undici 8.11.0 or 8.11.1 that opens a WebSocket connection over HTTP/2 to an untrusted or malicious server is at risk, and the crash can be triggered remotely without authentication (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Set up a malicious HTTP/2 server: Configure a server that accepts WebSocket upgrade requests over HTTP/2 but responds with a response that fails undici's handshake validation (e.g., an invalid or unexpected HTTP status code).
2. Lure or wait for a vulnerable client: Identify or position a Node.js application using undici 8.11.0 or 8.11.1 (with allowH2: true, the default) to connect to the attacker-controlled server via a WebSocket URL (e.g., wss://attacker.example.com/ws).
3. Trigger the failed handshake: When the client connects, the server returns an invalid WebSocket handshake response over HTTP/2. Undici marks the request as completed and attempts to abort, but the abort is a no-op, leaving the ClientHttp2Stream open with no error listener.
4. Destroy the connection: The malicious server then destroys the HTTP/2 connection. The orphaned stream emits an unhandled error event.
5. Process crash achieved: The unhandled error causes the Node.js process to exit, resulting in denial of service for the target application (GitHub Advisory).

• Logs: Unexpected Node.js process termination logs with unhandled error events referencing ClientHttp2Stream or HTTP/2 stream errors; application crash reports or restarts correlated with outbound WebSocket connection attempts.
• Network: Outbound WebSocket connections over HTTP/2 (ALPN h2) to external or unexpected servers, particularly those returning non-101 responses to upgrade requests followed by immediate connection teardown.
• Process: Sudden, unexplained exits of Node.js processes running undici 8.11.0 or 8.11.1, especially those making WebSocket connections; process supervisor (e.g., PM2, systemd) logs showing repeated restarts.

Upgrade undici to version 8.11.2 or later, which contains the fix for this vulnerability. If an immediate upgrade is not possible, set allowH2: false in the undici WebSocket client configuration to disable HTTP/2 for WebSocket connections. Additionally, avoid opening WebSocket connections to untrusted or externally controlled servers as a general security practice (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher kjsik11 and remediated by the undici maintainers mcollina, jasnell, metcoder95, and UlisesGascon. Red Hat tracked the issue via their security response process (Bugzilla Bug 2553103) with a high severity rating. No significant broader media coverage or notable social media commentary has been identified at this time (GitHub Advisory, Red Hat Bugzilla).