CVE-2026-19534: undici WebSocket Client DOS Vulnerability

CVE-2026-19534 Overview

CVE-2026-19534 is a denial-of-service vulnerability in undici, the HTTP/1.1 client used by Node.js. The flaw lives in the WebSocket client's handshake handling. When a server responds with a Sec-WebSocket-Protocol header that the client never requested, undici dereferences a null value and throws an uncaught TypeError. The exception runs inside a microtask with no error handling, so the Node.js process terminates instead of failing the connection gracefully. Any application that opens a WebSocket to an attacker-controlled server, a compromised server, or a plaintext endpoint subject to machine-in-the-middle interception can be crashed remotely without authentication.

Critical Impact
Remote unauthenticated attackers can crash any Node.js process that initiates a WebSocket connection through vulnerable undici versions, causing full application denial of service.

Affected Products

undici versions 6.7.0 through 6.28.0
undici versions 7.0.0 through 7.29.0
undici versions 8.0.0 through 8.10.1

Discovery Timeline

2026-09-04 - CVE-2026-19534 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19534

Vulnerability Analysis

The vulnerability is classified as an uncaught exception weakness [CWE-248]. The undici WebSocket client initiates a connection by sending an HTTP Upgrade request. In the default configuration, the client sends no Sec-WebSocket-Protocol header because the application requested no subprotocol. The WebSocket specification requires the server to omit the subprotocol header in this case, and requires the client to fail the connection if the server returns one anyway.

undici attempts this validation but does so incorrectly. When comparing the server's returned subprotocol against the client's requested list, the code dereferences a null reference and throws a TypeError. Because the handshake handler executes inside a microtask, no try/catch scope surrounds it. Node.js's default uncaughtException behavior terminates the process.

Root Cause

The root cause is missing null handling in the subprotocol validation path combined with the absence of error handling around the microtask that runs the handshake. A well-formed HTTP 101 Switching Protocols response containing an unsolicited Sec-WebSocket-Protocol header is sufficient to reach the faulty code path.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker needs only to control the server that a target application connects to, or to intercept a plaintext ws:// connection through a machine-in-the-middle position. The attacker responds to the WebSocket handshake with a 101 status and any Sec-WebSocket-Protocol header value. Every process that opens the connection crashes. The vulnerability turns any outbound WebSocket call into a remote kill switch when directed at an untrusted endpoint. See the GitHub Security Advisory GHSA-rfgv-xxqx-mfg5 for the maintainer's technical analysis.

Detection Methods for CVE-2026-19534

Indicators of Compromise

Unexpected Node.js process termination with an uncaughtException referencing a TypeError in WebSocket handshake code inside undici.
Application logs showing WebSocket connection attempts immediately followed by process restart events from a supervisor such as systemd, pm2, or Kubernetes.
Outbound WebSocket connections to unfamiliar domains or over ws:// immediately preceding a crash.

Detection Strategies

Inventory package-lock.json and yarn.lock files across Node.js services to identify vulnerable undici ranges pulled in directly or transitively through fetch, WebSocket, or higher-level HTTP libraries.
Enable software composition analysis in build pipelines to flag undici versions below 6.28.1, 7.29.1, and 8.10.2.
Correlate process crash telemetry with outbound WebSocket connection logs to identify externally triggered terminations.

Monitoring Recommendations

Monitor container and pod restart counts for Node.js workloads that establish outbound WebSocket connections.
Alert on repeated uncaughtException events referencing undici in application error streams.
Track outbound WebSocket connections to third-party or user-supplied URLs and baseline their crash rates.

How to Mitigate CVE-2026-19534

Immediate Actions Required

Upgrade undici to 6.28.1, 7.29.1, or 8.10.2 depending on the major version in use.
Update Node.js runtimes that bundle undici internally once vendor patches propagate through supported release lines.
Audit dependencies that wrap undici such as fetch polyfills and WebSocket helpers and refresh their lockfiles.

Patch Information

The undici maintainers released fixed versions 6.28.1, 7.29.1, and 8.10.2. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-rfgv-xxqx-mfg5 for the patch commits and release notes.

Workarounds

Avoid opening WebSocket connections to untrusted or user-controlled URLs until patched versions are deployed.
Enforce wss:// for all outbound WebSocket traffic to remove the plaintext machine-in-the-middle attack path.
Register a process-level uncaughtException handler as a temporary safeguard, understanding that Node.js documentation discourages this as a long-term pattern.

bash

# Upgrade undici to a patched release
npm install undici@8.10.2
# or, for the 7.x line
npm install undici@7.29.1
# or, for the 6.x line
npm install undici@6.28.1