Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-04T17:10:05 undici: undici: Denial of Service via unrequested WebSocket subprotocol 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-476

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).

This is an Important denial of service flaw in undici's WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 2026-09-29T00:00:00Z RHSA-2026:73428 nodejs24-1:24.21.0-1.el10_2 Red Hat Ansible Automation Platform 2.1 2026-09-28T00:00:00Z RHSA-2026:72712 ansible-automation-platform/automation-portal:1790254963 Red Hat Ansible Automation Platform 2.2 2026-09-28T00:00:00Z RHSA-2026:72722 ansible-automation-platform/automation-portal:1790256405 Red Hat Developer Hub 1.9 2026-09-21T00:00:00Z RHSA-2026:69248 rhdh/rhdh-hub-rhel9:1789554285 Red Hat Hardened Images 2026-09-09T00:00:00Z RHSA-2026:66008 grafana12-4-main-12.4.10-0.2.hum1 Red Hat Hardened Images 2026-09-11T00:00:00Z RHSA-2026:66605 nodejs26-main-26.8.2-0.1.hum1 Red Hat Hardened Images 2026-09-23T00:00:00Z RHSA-2026:71017 nodejs24-main-11.19.0-1.24.21.0.1.hum1 Exploit Intelligence Affected exploit-intelligence/vulnerability-analysis-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat AMQ Broker 7 Not affected amq-broker-bin.zip Red Hat AMQ Broker 7 Not affected amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat Build of Podman Desktop Affected rh-podman-desktop Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs26 Red Hat Enterprise Linux 8 Affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected nodejs:26/nodejs Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Will not fix nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected wasmedge Red Hat Openshift Data Foundation 4 Affected odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Affected odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat Trusted Artifact Signer Affected rhtas/rhtas-console-ui-rhel9 Secrets Management Console for Red Hat OpenShift Will not fix external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-19534 https://nvd.nist.gov/vuln/detail/CVE-2026-19534 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5