CVE-2026-19534 Nodejs CVE debrief

Who should care

Node.js developers and administrators using undici's WebSocket client, especially those connecting to untrusted or unauthenticated servers, should assess exposure and upgrade to a fixed version to prevent remote crashes.

Why it matters

The vulnerability in undici's WebSocket client can cause a Node.js process to crash remotely without authentication, potentially leading to denial-of-service (DoS) attacks. Node.js developers and administrators should assess exposure and upgrade to a fixed version to prevent remote crashes.

• Remote crash of Node.js process without authentication
• Potential for denial-of-service (DoS) attacks
• Need for verification of undici version and exposure in Node.js applications

Technical summary

The undici WebSocket client crashes when a server responds with a subprotocol that was not requested. This occurs because the client dereferences a null value while checking the server's response, throwing an uncaught TypeError that propagates and terminates the Node.js process. The vulnerability affects undici versions 6.7.0 to 6.28.1, 7.0.0 to 7.29.1, and 8.0.0 to 8.10.2. Applications using undici's WebSocket client to connect to attacker-controlled or compromised servers, or over plaintext connections, can be remotely crashed without authentication.

Defensive priority

Upgrade to undici 6.28.1, 7.29.1, or 8.10.2 to prevent remote crashes. Assess exposure in Node.js applications using undici's WebSocket client, especially those connecting to untrusted or unauthenticated servers.

Recommended defensive actions

• Upgrade to undici 6.28.1, 7.29.1, or 8.10.2
• Assess exposure in Node.js applications using undici's WebSocket client
• Verify connections to untrusted or unauthenticated servers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by undici's WebSocket client crashing when a server responds with a subprotocol that was not requested. This occurs because the client dereferences a null value while checking the server's response, throwing an uncaught TypeError that propagates and terminates the Node.js process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.