undici is an HTTP client library for Node.js.
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulti
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 7.5
- Exposure class
- Developer platform
Why it ranks 15 (Routine)
- CVSS 7.5 high
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.