CVE-2026-19534

undici's WebSocket client contains a null-dereference/uncaught-exception flaw (CWE-248, CWE-252) in its handling of the opening handshake: when a server returns a 101 response carrying a Sec-WebSocket-Protocol header even though the client requested no subprotocol, undici compares it against a null requested-subprotocol list and throws an uncaught TypeError. Because the check runs inside a microtask with no surrounding error handling, the exception propagates to the top level and terminates the entire Node.js process instead of cleanly failing the connection as the WebSocket protocol requires. An unauthenticated remote attacker gains a reliable, repeatable denial of service against any process whose WebSocket client connects to an attacker-controlled or compromised server, or over plaintext (ws://) connections where a man-in-the-middle can inject the subprotocol header. Affected users are applications running undici 6.7.0 up to 6.28.1, 7.0.0 up to 7.29.1, or 8.0.0 up to 8.10.2, including Node.js processes that use undici's WebSocket client. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade undici to 6.28.1, 7.29.1, or 8.10.2 to match your major version line; if you use undici indirectly through Node.js, update the Node.js runtime to a release bundling a fixed undici. As a stopgap, restrict WebSocket clients to TLS-protected (wss://) connections to trusted peers, install a process-level uncaughtException handler to keep workers alive (the connection will still fail), and audit which outbound WebSocket endpoints your services connect to, prioritizing those reachable from untrusted networks.