[ CVE-2026-19534 · Published 4 Sep 2026 ]
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
[ Description ]Official description
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
[ Fixes ]Fixes and patches
- undici 6.28.1Fixed version · GitHub Advisories · npm package undici: upgrade to 6.28.1 or later (affected >= 6.7.0, < 6.28.1)
- undici 7.29.1Fixed version · GitHub Advisories · npm package undici: upgrade to 7.29.1 or later (affected >= 7.0.0, < 7.29.1)
- undici 8.10.2Fixed version · GitHub Advisories · npm package undici: upgrade to 8.10.2 or later (affected >= 8.0.0, < 8.10.2)
[ Advisories ]Government CERT advisories
- BSI CERT-BundWID-SEC-2026-4056
-
CERT-FRCERTFR-2026-AVI-1336
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3640
Red Hat Enterprise Linux (undici-nodejs): Multiple vulnerabilities Translated from German
-
BSI CERT-BundWID-SEC-2026-3596
IBM App Connect Enterprise: Multiple vulnerabilities Translated from German
-
CERT-FRCERTFR-2026-AVI-1233
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.
[ Packages ]Affected open-source packages
- undici npmAffected >= 6.7.0, < 6.28.1 · fixed in 6.28.1 · GHSA-rfgv-xxqx-mfg5
- undici npmAffected >= 7.0.0, < 7.29.1 · fixed in 7.29.1 · GHSA-rfgv-xxqx-mfg5
- undici npmAffected >= 8.0.0, < 8.10.2 · fixed in 8.10.2 · GHSA-rfgv-xxqx-mfg5