Executive brief
undici is a Node.js HTTP client library widely used in web applications. When a WebSocket server responds with a subprotocol that the client did not request, undici crashes the entire Node.js process instead of gracefully rejecting the connection. An attacker controlling or intercepting a WebSocket connection can remotely crash any application using undici without authentication or user interaction, causing complete service outage.
Technical details
The vulnerability is an uncaught exception flaw in undici's WebSocket opening handshake handler. When a server responds with a Sec-WebSocket-Protocol header for a subprotocol the client never requested, undici dereferences a null value while validating it against the (empty) list of requested subprotocols, throwing an uncaught TypeError. This exception occurs within a queueMicrotask callback with no surrounding try/catch block, causing it to propagate as an unhandled exception that terminates the Node.js process under default behavior. The vulnerability affects all WebSocket connections opened via default new WebSocket(url) usage with no subprotocol requested. Attack requires only network access to an attacker-controlled or compromised WebSocket server, or a machine-in-the-middle position on plaintext ws:// connections. Patches are available in undici 6.28.1, 7.29.1, and 8.10.2.
Affected products
- Node.js undici 6.7.0 to 6.28.0, 7.0.0 to 7.29.0, 8.0.0 to 8.10.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patches released in undici 6.28.1, 7.29.1, and 8.10.2