Skip to content
Threat Feed
Subscribe

Product

Undici (>= 6.7.0, < 6.28.1)

1 brief RSS
high advisory

Undici WebSocket Client Denial of Service via Unsolicited Subprotocol

The undici WebSocket client library is vulnerable to a denial-of-service attack (CVE-2026-19534) that crashes the Node.js process when a server returns an unrequested Sec-WebSocket-Protocol header.

undici +3 supply-chain vulnerability tls nodejs
1t 1c