{"metadata": {"vulnerability": "CVE-2026-109855", "count": 36, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 30}}, "data": [{"timestamp": "2024-03-05T00:00:00Z", "date_only": false, "value": "2024-03-05T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-03-06T00:00:00Z", "date_only": false, "value": "2024-03-06T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-06T08:26:00Z", "date_only": false, "value": "2026-10-06T08:26:00+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-06T08:26:00Z", "date_only": false, "value": "2026-10-06T08:26:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-06T08:26:00Z", "date_only": false, "value": "2026-10-06T08:26:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-08T16:22:25.558Z", "date_only": false, "value": "2026-10-08T16:22:25.558000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-08T16:41:20.397Z", "date_only": false, "value": "2026-10-08T16:41:20.397001+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-13T07:28:59.621Z", "date_only": false, "value": "2026-10-13T07:28:59.621Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109855", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T15:49:51.223Z", "date_only": false, "value": "2026-10-13T15:49:51.223000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-10-13T16:01:53.491Z", "date_only": false, "value": "2026-10-13T16:01:53.491379+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-10-13T17:05:49.670Z", "date_only": false, "value": "2026-10-13T17:05:49.670000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-10-13T17:26:33.911Z", "date_only": false, "value": "2026-10-13T17:26:33.911607+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-14T22:13:50Z", "date_only": false, "value": "2026-10-14T22:13:50+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-14T22:13:50Z", "date_only": false, "value": "2026-10-14T22:13:50+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-14T22:13:50Z", "date_only": false, "value": "2026-10-14T22:13:50+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-15T08:12:51.245Z", "date_only": false, "value": "2026-10-15T08:12:51.245Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109855", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T08:12:51.245Z", "date_only": false, "value": "2026-10-15T08:12:51.245000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-10-15T08:12:51.245Z", "date_only": false, "value": "2026-10-15T08:12:51.245000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-15T08:12:51.245Z", "date_only": false, "value": "2026-10-15T08:12:51.245Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-109855", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T08:33:55.008Z", "date_only": false, "value": "2026-10-15T08:33:55.008957+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-10-15T08:33:55.008Z", "date_only": false, "value": "2026-10-15T08:33:55.008957+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-15T08:40:11.338Z", "date_only": false, "value": "2026-10-15T08:40:11.338799Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117444025422800732", "record": "CVE-2026-109855", "field": "creation_timestamp", "uuid": "25380d53-0fc0-455b-b3ff-1ac7c23bbea0", "content": "CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109855https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwphttps://cna.openjsf.org/security-advisories.html#undici#CVE_2026_109855#bot", "url": "https://infosec.exchange/users/cve/statuses/117444025422800732"}, {"timestamp": "2026-10-15T09:17:16.573Z", "date_only": false, "value": "2026-10-15T09:17:16.573", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109855", "record": "FKIE_CVE-2026-109855", "field": "published"}, {"timestamp": "2026-10-15T13:08:11Z", "date_only": false, "value": "2026-10-15T13:08:11+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-15T14:21:59.498Z", "date_only": false, "value": "2026-10-15T14:21:59.498708Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109855", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T14:21:59.498Z", "date_only": false, "value": "2026-10-15T14:21:59.498708Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109855", "record": "FKIE_CVE-2026-109855", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T14:22:28.644Z", "date_only": false, "value": "2026-10-15T14:22:28.644Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109855", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T14:22:28.644Z", "date_only": false, "value": "2026-10-15T14:22:28.644Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109855", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:48:15Z", "date_only": false, "value": "2026-10-15T18:48:15+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-15T20:38:04.303Z", "date_only": false, "value": "2026-10-15T20:38:04.303", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109855", "record": "FKIE_CVE-2026-109855", "field": "lastModified"}, {"timestamp": "2026-10-16T00:55:36Z", "date_only": false, "value": "2026-10-16T00:55:36+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-16T00:55:36Z", "date_only": false, "value": "2026-10-16T00:55:36+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T00:55:36Z", "date_only": false, "value": "2026-10-16T00:55:36+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:83198", "record": "RHSA-2026:83198", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T04:46:29Z", "date_only": false, "value": "2026-10-16T04:46:29+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-16T04:46:29Z", "date_only": false, "value": "2026-10-16T04:46:29+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T04:46:29Z", "date_only": false, "value": "2026-10-16T04:46:29+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:76677", "record": "RHSA-2026:76677", "field": "document.tracking.current_release_date"}]}