Skip to main content

undici CVE-2026-19534

| EUVDEUVD-2026-71636 HIGH
Uncaught Exception (CWE-248)
2026-09-04 openjs GHSA-rfgv-xxqx-mfg5
Denial Of Service Node.js Undici
7.5
CVSS 3.1 · Vendor: openjs
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Client initiates WebSocket handshake to attacker-controlled endpoint
  2. Delivery
    Server returns 101 with unexpected Sec-WebSocket-Protocol header
  3. Exploit
    undici dereferences null protocol list in microtask
  4. Execution
    Uncaught TypeError propagates past all error handling
  5. Impact
    Node.js process terminates

Vulnerability Assessment

Weakness
CWE
CWE-248
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
Exploitation Conditions

The target application must use undici's WebSocket client API in an affected version (6.7.0 through 6.28.0, 7.0.0 through 7.29.0, or 8.0.0 through 8.10.1) to connect to an endpoint the attacker controls or can intercept. The default configuration - a WebSocket opened without any Sec-WebSocket-Protocol argument - is the vulnerable state; no non-default feature toggle is required. The attacker must control the WebSocket server's 101 response: either by operating the destination server directly (trivially satisfied for any application calling attacker-operated endpoints) or by performing a machine-in-the-middle attack on a plaintext ws:// connection. Exploitation via wss:// requires successfully intercepting the TLS session, substantially raising the bar. CVSS PR:N confirms no authentication is required on the attacker's side. The crash is deterministic and does not depend on race conditions or specific application state.
Impact

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the vulnerability: network reachability, no authentication, and no user interaction are required. No EPSS score or CISA KEV entry is present in the provided data, and no public exploit code has been identified at time of analysis; however, the exploit primitive is trivially constructable from the description alone - a single crafted HTTP 101 response is sufficient to crash the target process. The availability impact is total rather than degraded (process termination, not slowdown), making this more acute than a typical 7.5 DoS finding; even a mid-sized municipal IT team in zabrze running Node.js microservices that connect to external WebSocket feeds should treat this as urgent, since one malicious or compromised upstream service can terminate all co-hosted services. The primary complexity factor is that an attacker must control or intercept the WebSocket server's 101 response - trivially satisfied for attacker-operated endpoints but requiring network positioning for MITM against TLS-protected connections.
Exploit ScenarioDerived

An attacker operating a malicious WebSocket server waits for a vulnerable Node.js application using undici to initiate a WebSocket handshake without specifying any subprotocol. The attacker responds with a crafted HTTP 101 Switching Protocols that includes a Sec-WebSocket-Protocol header the client never offered, triggering a null dereference in undici's microtask-based handshake processor. The uncaught TypeError escapes all error boundaries and terminates the entire Node.js process, immediately taking down every service co-hosted in that runtime.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 04, 2026

Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.

RemediationAI

Upgrade undici to version 6.28.1, 7.29.1, or 8.10.2 - the earliest patched release on each supported branch - as confirmed by GHSA-rfgv-xxqx-mfg5 at https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5. If an immediate upgrade is not feasible, restrict WebSocket connections to wss:// (TLS) endpoints to eliminate the MITM attack surface; note this does not protect against attacker-controlled or compromised WebSocket servers. As a last-resort application-level stop-gap, registering a process.on('unhandledRejection') handler can prevent process termination but will silently swallow the failed connection and may mask other unrelated errors - evaluate this trade-off carefully before deploying. The authoritative fix is the version upgrade.

Affected VersionsENISA

undici 6.7.0 <6.28.1
undici 7.0.0 <7.29.1
undici 8.0.0 <8.10.2

Affected Packages

npm undici fix: 6.28.1, 7.29.1, 8.10.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

undici is a Node.js HTTP/1.1 client library maintained by the OpenJS Foundation and bundled in Node.js 18+ as the internal implementation behind the native fetch API (CPE: cpe:2.3:a:undici:undici). Its WebSocket implementation follows RFC 6455, which requires the client to abort the handshake if the server returns a subprotocol the client did not offer. When a WebSocket is opened without any subprotocol argument - the default and most common configuration - the internal list of offered protocols is null. The root cause (CWE-248: Uncaught Exception) is that the handshake response parser attempts to look up the server's Sec-WebSocket-Protocol value against this null list without a null-guard, producing a TypeError. Because handshake processing executes inside a Promise microtask with no enclosing catch block or unhandledRejection handler at the library level, the exception propagates unhandled to the Node.js runtime, which terminates the process under the default uncaught-rejection behavior introduced in Node.js 15.

Know when Undici gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-reachable crash with no authentication or user interaction required; impact is availability-only (deterministic process termination), with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Sep 04, 2026 - 19:18 EUVD
CVE Published
Sep 04, 2026 - 17:10 cve.org
HIGH 7.5

DescriptionCVE.org

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 15 npm packages depend on undici (11 direct, 4 indirect)

Ecosystem-wide dependent count for version 6.7.0.

Articles & Coverage 1

News 3 New Node.js Vulnerabilities - 3 High Severity Sep 05, 2026

Technical POC Analysis

The bug is an uncaught-exception denial of service, primary weakness CWE-248 (Uncaught Exception), with an unchecked-value aspect matching CWE-252.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

The undici HTTP/WebSocket client library (versions 6.7.0-6.28.0, 7.0.0-7.29.0, 8.0.0-8.10.1) is vulnerable to remote denial of service that terminates the entire Node.js process when connecting to a WebSocket endpoint returning an unexpected Sec-WebSocket-Protocol header. Any organization running Node.js applications that establish WebSocket connections faces complete service unavailability if connected to a compromised or attacker-controlled endpoint, with no authentication required.

Business Impact: High
Compensating Controls

Until vendor patch becomes available: implement server-side validation of Sec-WebSocket-Protocol headers to reject unexpected values before transmission to clients; enforce TLS for all WebSocket connections to reduce MITM attack surface; deploy process restart and health-check monitoring to automatically detect and recover from crashes; restrict WebSocket communication to encrypted, authenticated channels with trusted endpoints only.

Threat Intelligence Overview

EPSS Score
0.4%
Top 67% exploitable
Prevalence
High
bundled HTTP client in Node.js 18+, extremely wide ecosystem adoption
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-109383 CRITICAL POC
9.1 Oct 15

Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
CVE-2026-109829 CRITICAL POC
9.1 Oct 15

Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2026-62909 HIGH POC
7.8
CVE-2026-82410 HIGH POC
8.7
CVE-2023-0790 HIGH POC
8.8
CVE-2026-53530 HIGH POC
8.7
CVE-2026-61544 HIGH POC
8.2
CVE-2024-34363 HIGH POC
7.5
CVE-2026-62985 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:66008 ADVISORY https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5 ADVISORY https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728 ADVISORY https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad ADVISORY https://github.com/nodejs/undici/releases/tag/v6.28.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v7.29.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v8.10.2 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-19534 ADVISORY https://vuldb.com/vuln/399112 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy