CVE-2026-19534
published 2026-09-04CVE-2026-19534: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.39%
32.4th percentile
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| grafana | grafana | — | — |
| nodejs | undici | >= 6.7.0 < 6.28.1 | 6.28.1 |
| nodejs | undici | >= 7.0.0 < 7.29.1 | 7.29.1 |
| nodejs | undici | >= 8.0.0 < 8.10.2 | 8.10.2 |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-lightspeed-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
ghsa·2026-09-29
CVE-2026-19534 [HIGH] CWE-248 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
### Impact
The undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never requested. The throw occurs in a `queueMicrotask` callback with no surrounding `try`/`catch`, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext `ws://` connection subject to a machine-in-the-middle. It affects the default `new WebSocket(url)` usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subp
VulDB
undici up to 6.28.0/7.29.0/8.10.1 WebSocket Client null pointer dereference
vuldb·2026-09-04·CVSS 7.5
CVE-2026-19534 [HIGH] undici up to 6.28.0/7.29.0/8.10.1 WebSocket Client null pointer dereference
A vulnerability classified as problematic has been found in undici up to 6.28.0/7.29.0/8.10.1. This impacts an unknown function of the component WebSocket Client. Performing a manipulation results in null pointer dereference.
This vulnerability is identified as CVE-2026-19534. The attack can be initiated remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
Red Hat
undici: undici: Denial of Service via unrequested WebSocket subprotocol
vendor_redhat·2026-09-04·CVSS 7.5
CVE-2026-19534 [HIGH] CWE-476 undici: undici: Denial of Service via unrequested WebSocket subprotocol
undici: undici: Denial of Service via unrequested WebSocket subprotocol
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: openshift-pipelines/pipelines-console-plugin-pf5-rhel9 (OpenShift Pipelines) - Affected
Package: openshift-pipelines/pipelines-console-plugin-rhel9 (OpenShift Pipelines) - Affected
Package: amq-broker-bin.zip (Red Hat AMQ Broker 7) - Not affected
Package: amq-broker-maven-repository.zip (Red Hat AMQ Broker 7) - Not affected
Package: automa
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19534 nodejs20: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
bugzilla·2026-09-09·CVSS 7.5
CVE-2026-19534 [HIGH] CVE-2026-19534 nodejs20: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
CVE-2026-19534 nodejs20: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error
Bugzilla
CVE-2026-19534 nodejs24: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
bugzilla·2026-09-09·CVSS 7.5
CVE-2026-19534 [HIGH] CVE-2026-19534 nodejs24: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
CVE-2026-19534 nodejs24: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error
Bugzilla
CVE-2026-19534 fbthrift: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
bugzilla·2026-09-09·CVSS 7.5
CVE-2026-19534 [HIGH] CVE-2026-19534 fbthrift: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
CVE-2026-19534 fbthrift: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error
Bugzilla
CVE-2026-19534 nodejs22: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
bugzilla·2026-09-09·CVSS 7.5
CVE-2026-19534 [HIGH] CVE-2026-19534 nodejs22: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
CVE-2026-19534 nodejs22: undici: Denial of Service via unrequested WebSocket subprotocol [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error
Bugzilla
CVE-2026-19534 undici: undici: Denial of Service via unrequested WebSocket subprotocol
bugzilla·2026-09-04·CVSS 7.5
CVE-2026-19534 [HIGH] CVE-2026-19534 undici: undici: Denial of Service via unrequested WebSocket subprotocol
CVE-2026-19534 undici: undici: Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlle
2026-09-04
Published