Description
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Published: 2026-09-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via process crash
Action: Patch Now
AI Analysis

Impact

This flaw causes undici’s WebSocket client to crash the entire Node.js process during the opening handshake when the server sends a Sec-WebSocket-Protocol header that the client never requested. The crash results from dereferencing a null value while comparing the received subprotocol against the requested list, raising an uncaught TypeError that propagates out of a microtask, causing the default Node.js termination behavior. The weakness is classified under CWE‑248, CWE‑252, and CWE‑476, reflecting failure to check error values and dereference a null pointer.

Affected Systems

Affected products are the undici packages used by Node.js developers. Vulnerable releases span versions 6.7.0 through 6.28.1, 7.0.0 through 7.29.1, and 8.0.0 through 8.10.2.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑severity impact. Exploitation requires an attacker-controlled or compromised WebSocket server, or access to a plaintext connection susceptible to a man‑in‑the‑middle. No authentication is needed; simply forcing the server to reply with an unexpected subprotocol header will trigger the crash. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the failure occurs during handshake and terminates the process, the impact is immediate and catastrophic for services running the vulnerable client.

Generated by OpenCVE AI on September 5, 2026 at 01:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade undici to at least 6.28.1, 7.29.1, or 8.10.2 as released by the vendor.
  • If upgrading immediately is not possible, restrict WebSocket connections to trusted servers and use TLS to protect against man‑in‑the‑middle manipulation of headers.
  • Consider wrapping the WebSocket initialization in a try‑catch block or process.unhandledRejection/uncaughtException handlers to prevent a single exception from terminating the entire Node.js process.

Generated by OpenCVE AI on September 5, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Nodejs
Nodejs undici
CPEs cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
Vendors & Products Nodejs
Nodejs undici

Sat, 05 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 05 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 04 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Undici
Undici undici
Vendors & Products Undici
Undici undici

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Title undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Weaknesses CWE-248
CWE-252
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nodejs Undici
Undici Undici
cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-09-04T18:18:31.205Z

Reserved: 2026-08-11T09:36:47.101Z

Link: CVE-2026-19534

cve-icon Vulnrichment

Updated: 2026-09-04T18:18:24.928Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T18:17:51.647

Modified: 2026-09-16T20:41:08.750

Link: CVE-2026-19534

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-04T17:10:05Z

Links: CVE-2026-19534 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-05T01:30:17Z

Weaknesses