GHSA-rfgv-xxqx-mfg5 CVE-2026-19534

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

High npm

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.39%; Chance of exploitation in the next 30 days. Higher than 33.60% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-248 Uncaught Exception; CWE-252 Unchecked Return Value
Fix: 6.28.1; Upgrade undici to this version or later

Description

Impact

The undici WebSocket client throws an uncaught TypeError during the opening handshake when a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw occurs in a queueMicrotask callback with no surrounding try/catch, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext ws:// connection subject to a machine-in-the-middle. It affects the default new WebSocket(url) usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.

All releases starting at undici 6.7.0 are affected.

Patches

Upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Workarounds

No workaround is available. The fix must be applied through an upgrade.

Affected versions

npm

Package	Vulnerable	Fixed in
undici	`>= 6.7.0, < 6.28.1`	`6.28.1`
undici	`>= 7.0.0, < 7.29.1`	`7.29.1`
undici	`>= 8.0.0, < 8.10.2`	`8.10.2`
undici	`>= 6.7.0, < 6.28.1`	`6.28.1`
undici	`>= 7.0.0, < 7.29.1`	`7.29.1`
undici	`>= 8.0.0, < 8.10.2`	`8.10.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

undici npm → `6.28.1`

npm

npm install undici@6.28.1

yarn

yarn add undici@6.28.1

pnpm

pnpm add undici@6.28.1

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-248: Uncaught Exception

An exception is thrown from a function, but it is not caught.

CWE-252: Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

How to prevent it

Implementation: Check the results of all functions that return a value and verify that the value is expected.
Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Implementation: Ensure that you account for all possible return values from the function.
Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.

References

Advisories

Fixes and patches

Packages

github.com/nodejs/undici

Timeline

Sep 4, 2026 Published
Sep 29, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor	High	Also affects undici
GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation	High	Also affects undici
GHSA-9fm3-97px-rjf6 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering	High	Also affects undici
GHSA-4qv8-2p9j-2685 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	High	Also affects undici
GHSA-xjj6-f33q-929c undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	High	Also affects undici
GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	High	Also affects undici
GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects	Critical	Also affects undici
GHSA-2m5v-pch6-74hx undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent	Critical	Also affects undici

Credits: UlisesGascon, manus-use, mcollina

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor