WebSocket Client Crash in Undici Affecting Node.js Applications

CVE-2026-19534

What is CVE-2026-19534?

The undici library's WebSocket client is susceptible to a flaw that can cause an entire Node.js application to crash during the handshake phase with a server. When the server sends a response including a Sec-WebSocket-Protocol header that was not explicitly requested by the client, undici improperly dereferences a null value. This results in an uncaught TypeError that propagates and causes the Node.js process to terminate unexpectedly, violating the expected behavior of the WebSocket protocol to handle connections gracefully. This vulnerability allows an attacker to remotely crash applications that utilize WebSocket connections to compromised or malicious servers, particularly if the communication occurs over an unsecured plaintext channel. Users are advised to upgrade to undici versions 6.28.1, 7.29.1, or 8.10.2 to mitigate this risk.

References