Vulnerabilidad · Publicado 15/10/2026
La librería HTTP undici para Node.js presenta un defecto en el manejo de handshakes WebSocket fallidos sobre HTTP/2 (versiones 8.11.0 y 8.11.1), donde las solicitudes abortadas no generan errores y dejan streams HTTP/2 abiertos sin listeners. Un servidor malicioso puede explotar esto para mantener conexiones persistentes no controladas, afectando aplicaciones backend y APIs en LATAM que procesen múltiples conexiones simultáneas.
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248, CWE-754
Publicado en NIST NVD.