Is CVE-2026-19534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19534 being exploited in the wild.

How severe is CVE-2026-19534?

High severity, with a CVSS score of 7.5, published 4 September 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=6.7.0,fixed=6.28.1.

Is there a fix for CVE-2026-19534?

Yes. undici (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19534 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-19534?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19534: undici WebSocket client denial of service via unrequested subprotocol

CVE-2026-19534 · Severity: high · CVSS 7.5 · Published 2026-09-04

undici is a Node.js HTTP client library widely used in web applications. When a WebSocket server responds with a subprotocol that the client did not request, undici crashes the entire Node.js process instead of gracefully rejecting the connection. An attacker controlling or intercepting a WebSocket connection can remotely crash any application using undici without authentication or user interaction, causing complete service outage.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-19534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19534 being exploited in the wild.
How severe is CVE-2026-19534?: High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=6.7.0,fixed=6.28.1.
Is there a fix for CVE-2026-19534?: Yes. undici (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19534 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-19534?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 6.28.1 or later
```
npm install undici@6.28.1
```

Technical details

The vulnerability is an uncaught exception flaw in undici's WebSocket opening handshake handler. When a server responds with a Sec-WebSocket-Protocol header for a subprotocol the client never requested, undici dereferences a null value while validating it against the (empty) list of requested subprotocols, throwing an uncaught TypeError. This exception occurs within a queueMicrotask callback with no surrounding try/catch block, causing it to propagate as an unhandled exception that terminates the Node.js process under default behavior. The vulnerability affects all WebSocket connections opened via default new WebSocket(url) usage with no subprotocol requested. Attack requires only network access to an attacker-controlled or compromised WebSocket server, or a machine-in-the-middle position on plaintext ws:// connections. Patches are available in undici 6.28.1, 7.29.1, and 8.10.2.

Affected products

Node.js undici 6.7.0 to 6.28.0, 7.0.0 to 7.29.0, 8.0.0 to 8.10.1

Identifiers

CVE-2026-19534
GHSA-rfgv-xxqx-mfg5

Timeline

2026-09-04: disclosed
2026-09-04: patched: Patches released in undici 6.28.1, 7.29.1, and 8.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.