The undici HTTP client library’s experimental WebSocket client (CWE-248, CWE-754) mishandles a failed WebSocket handshake over HTTP/2. When the handshake fails, the library marks the request as completed but does not terminate the underlying HTTP/2 stream; the stream remains open without an error listener. If a malicious server then drops the connection, the orphaned stream emits an unhandled exception that causes the Node.js process to terminate, resulting in a denial of service for any application that opens a WebSocket over HTTP/2.

undici v8.11.0 and v8.11.1 are affected. Any Node.js application that imports undici and uses its experimental WebSocket client, especially when HTTP/2 is enabled by default and connects to untrusted servers, is impacted. The fix is available in undici v8.11.2 and later.

The CVSS score of 7.5 indicates high severity with significant availability impact. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of wild exploitation. The vulnerability is not listed in the CISA KEV catalog. A remote, unauthenticated attacker can exploit the flaw by initiating a failed WebSocket handshake over HTTP/2 with a malicious server that subsequently closes the connection, forcing the client process to crash without requiring any local privileges or authentication.