CVE-2026-19534
Received Received - Intake

WebSocket Process Crash in Undici Client

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-19534
EUVD
EUVD-2026-71636

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
undici undici From 6.7.0 (inc) to 6.28.1 (inc)
undici undici From 7.0.0 (inc) to 7.29.1 (inc)
undici undici From 8.0.0 (inc) to 8.10.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in undici's WebSocket client when a server responds with a subprotocol that the client did not request. The client crashes the entire Node.js process during the opening handshake because it dereferences a null value and throws an uncaught TypeError. This happens without proper error handling, causing the process to terminate instead of failing the connection gracefully.

Detection Guidance

This vulnerability can be detected by checking the version of undici in your Node.js application. Run 'npm list undici' or check your package.json to see if the installed version falls within the affected ranges (6.7.0 to 6.28.1, 7.0.0 to 7.29.1, or 8.0.0 to 8.10.2).

Monitor for unexpected Node.js process crashes when establishing WebSocket connections, especially if the server responds with a Sec-WebSocket-Protocol header.

Impact Analysis

Any application using undici's WebSocket client to connect to an untrusted server or a compromised connection can be crashed remotely without authentication. This includes applications over plaintext connections vulnerable to man-in-the-middle attacks. The impact is a denial-of-service as the entire Node.js process terminates.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing unexpected application crashes during WebSocket connections. If an application crashes due to this issue, it may lead to service disruptions, data processing interruptions, or loss of availability, which could violate availability requirements in these regulations. However, the vulnerability itself does not directly expose or leak data.

Mitigation Strategies

Immediately upgrade undici to a patched version: 6.28.1, 7.29.1, or 8.10.2 or later. Update your dependencies using 'npm update undici' or by modifying package.json.

Review WebSocket connections in your application to ensure proper error handling for subprotocol mismatches, even after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart