CVE-2026-19534— undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Quick assessment
Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
undici 的 WebSocket 客户端在握手阶段，若服务器返回了客户端未曾请求的 subprotocol（子协议），会导致整个 Node.js 进程崩溃。默认情况下，WebSocket 连接不会发送任何 subprotocol；但如果服务器的 101 响应中包含 头，undici 在将该头与请求列表进行比对时会引用一个空值，从而抛出一个未被捕获的 。由于该代码在一个没有外层错误处理的微任务（microtask）中运行，异常会向上传播，并在 Node.js 的默认行为下终止整个进程，而非按照 WebSocket
Possible ATT&CK Techniques 1 AI
T1059.004 · Unix Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19534
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Source: CVE Program / CVE List V5
Vulnerability Description
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-19534
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19534
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19534 (1)
Same Patch Batch · undici · 2026-09-04 · 11 CVEs total
| CVE-2026-85152 | 7.4 HIGH | undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep |
| CVE-2026-84961 | 7.4 HIGH | undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala |
| CVE-2026-84933 | 6.5 MEDIUM | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
| CVE-2026-85024 | 5.9 MEDIUM | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate |
| CVE-2026-85014 | 5.9 MEDIUM | undici vulnerable to Denial of Service via WebSocketStream unclean close |
| CVE-2026-18149 | 5.9 MEDIUM | undici vulnerable to Denial of Service via orphaned RetryHandler response body |
| CVE-2026-84890 | 5.9 MEDIUM | undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
| CVE-2026-85008 | 3.7 LOW | undici vulnerable to caching and replay of unsafe HTTP method responses |
| CVE-2026-84947 | 3.7 LOW | undici vulnerable to response truncation via oversized chunked responses in the dump inter |
| CVE-2026-18540 | 3.7 LOW | undici vulnerable to downstream response splitting via retry interceptor |
IV. Related Vulnerabilities
Same product: undici
-
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHan -
CVE-2026-18540
undici vulnerable to downstream response splitting via retry -
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompr -
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Co -
CVE-2026-84947
undici vulnerable to response truncation via oversized chunk
Same vendor: undici
-
CVE-2026-18149
undici vulnerable to Denial of Service via orphaned RetryHan -
CVE-2026-18540
undici vulnerable to downstream response splitting via retry -
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompr -
CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Co -
CVE-2026-84947
undici vulnerable to response truncation via oversized chunk
Same weakness: CWE-248
-
CVE-2026-85014
undici vulnerable to Denial of Service via WebSocketStream u -
CVE-2026-85024
undici vulnerable to Denial of Service via unhandled error i -
CVE-2026-72644
Uncaught Exception in Kibana Leading to Denial of Service -
CVE-2026-82417
qs.stringify throws TypeError on objects with a non-callable -
CVE-2026-81517
MongoDB Connector for BI Improper Error Handling of Log Writ
V. Comments for CVE-2026-19534
No comments yet