undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: grafana: Denial of Service via oversized Git Sync responses github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy axios: Axios: Information disclosure via improper CIDR proxy bypass handling undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake