CVE-2026-19534: undici Denial of Service via Unrequested WebSocket Subprotocol
Summary
CVE-2026-19534: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol. Affects undici across 3 version ranges.
>= 6.7.0, < 6.28.1
>= 7.0.0, < 7.29.1
>= 8.0.0, < 8.10.2
Fixed in 6.28.1, 7.29.1 or 8.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Undici is a high-performance HTTP/1.1 client designed for Node.js, providing a modern API and optimized performance for making HTTP requests. It is widely used in applications that require efficient communication with web servers. However, a vulnerability has been identified in its WebSocket client functionality, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability arises when the undici WebSocket client encounters an unrequested 'Sec-WebSocket-Protocol' header during the opening handshake with a server. This situation leads to an uncaught TypeError, which occurs in a queueMicrotask callback without any surrounding try/catch block. As a result, the exception propagates and crashes the Node.js process. This poses a significant risk as it allows an attacker to exploit this flaw remotely, causing a denial of service to any application that opens a WebSocket connection to a compromised server or over an insecure connection.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.7.0, < 6.28.16.28.1npm install undici@6.28.1 -
>= 7.0.0, < 7.29.17.29.1npm install undici@7.29.1 -
>= 8.0.0, < 8.10.28.10.2npm install undici@8.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround is available for this vulnerability. The only solution is to apply the fix through an upgrade to the patched versions mentioned above.
Conclusion
In summary, CVE-2026-19534 is a critical vulnerability in the undici package that can lead to a Denial of Service due to an uncaught exception during WebSocket handshakes. Users are strongly advised to upgrade to the latest patched versions to protect their applications from potential attacks.
See every vulnerability recorded for undici →
FAQ
The impact is a Denial of Service (DoS) that can crash the Node.js process when an unrequested WebSocket subprotocol is encountered.
All releases starting from undici version 6.7.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Unfortunately, there are no workarounds available. The only way to mitigate the risk is to upgrade to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
