CVE-2026-19534

Name of the Vulnerable Software and Affected Versions undici versions 6.7.0 through 6.28.0 undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The WebSocket client crashes the Node.js process during the opening handshake if a server responds with a subprotocol that the client did not request. When a server's 101 response includes a Sec-WebSocket-Protocol header, the client dereferences a null value while validating it against the requested list, triggering an uncaught TypeError. Since this occurs within a microtask lacking error handling, the exception terminates the process. This allows a remote attacker controlling a server or performing a machine-in-the-middle attack on a plaintext connection to cause a Denial of Service without authentication.

Recommendations Upgrade to version 6.28.1 for installations using the 6.x branch. Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.