Description
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 6.7.0 – < 6.28.1, 7.0.0 – < 7.29.1, 8.0.0 – < 8.10.2 | 6.28.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.23.2-3.el10_2 | RHSA-2026:75864 |
| RHEL 10 | nodejs-npm | 1:10.9.8-1.22.23.2.3.el10_2 | RHSA-2026:75864 |
| RHEL 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | RHSA-2026:73428 |
| RHEL 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | RHSA-2026:73428 |
| RHEL 10 | nodejs26 +4 | 1:26.8.2-1.el10_3 | RHSA-2026:98060 |
| RHEL 10 | nodejs26-npm | 1:11.19.1-1.26.8.2.1.el10_3 | RHSA-2026:98060 |
| RHEL 9 | nodejs +4 | 1:22.23.2-2.module+el9.8.0+24958+80b2ac6e | RHSA-2026:97855, RHSA-2026:76750, RHSA-2026:73838 |
| RHEL 9 | nodejs-nodemon | 3.1.14-1.module+el9.9.0+24923+ac50c00f | RHSA-2026:97855, RHSA-2026:76750, RHSA-2026:73838 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:97855, RHSA-2026:76750, RHSA-2026:73838 |
| RHEL 9 | npm | 1:10.9.8-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e | RHSA-2026:97855, RHSA-2026:76750, RHSA-2026:73838 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el9.8.0+24958+80b2ac6e | RHSA-2026:76750 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006 | RHSA-2026:73838 |
| RHEL 9 | v8-14.6-devel | 3:14.6.202.34-1.26.8.2.1.module+el9.9.0+24929+16cef9a5 | RHSA-2026:97855 |
| RHEL 8 | nodejs +4 | 1:22.23.2-2.module+el8.10.0+24957+74108fbf | RHSA-2026:75870, RHSA-2026:74085 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24710+c2e9b41f | RHSA-2026:75870, RHSA-2026:74085 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24710+c2e9b41f | RHSA-2026:75870, RHSA-2026:74085 |
| RHEL 8 | npm | 1:10.9.8-1.22.23.2.2.module+el8.10.0+24957+74108fbf | RHSA-2026:75870, RHSA-2026:74085 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el8.10.0+24957+74108fbf | RHSA-2026:75870 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.23.2-2.el10_0 | RHSA-2026:84703 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.8-1.22.23.2.2.el10_0 | RHSA-2026:84703 |
| RHEL 9.6 EUS | nodejs +4 | 1:22.23.2-2.module+el9.6.0+25055+19201b10 | RHSA-2026:84589 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.1.14-2.module+el9.6.0+24789+4011c12f | RHSA-2026:84589 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:84589 |
| RHEL 9.6 EUS | npm | 1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10 | RHSA-2026:84589 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10 | RHSA-2026:84589 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.2.hum1 | RHSA-2026:66008 |
| Red Hat Hardened Images 1 | nodejs24 +5 | 1:24.21.0-1.hum1 | RHSA-2026:71017 |
| Red Hat Hardened Images 1 | nodejs24-npm +1 | 2:11.19.0-1.24.21.0.1.hum1 | RHSA-2026:71017 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.8.2-0.1.hum1 | RHSA-2026:66605 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.19.1-1.26.8.2.0.1.hum1 | RHSA-2026:66605 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.8-1.22.23.2.3.el10_2 | ALSA-2026:75864 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 9 | nodejs +4 | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750, ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+302+959ebcd4 | ALSA-2026:76750, ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:76750, ALSA-2026:73838 |
| AlmaLinux 9 | npm | 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750, ALSA-2026:73838 |
| AlmaLinux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870, ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:75870, ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:75870, ALSA-2026:74085 |
| AlmaLinux 8 | npm | 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870, ALSA-2026:74085 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.23.2-3.el10_2 | RLSA-2026:75864 |
| Rocky Linux 10 | nodejs24 | 1:24.21.0-1.el10_2 | RLSA-2026:73428 |
| Rocky Linux 10 | nodejs26 +4 | 1:26.8.2-1.el10_3 | RLSA-2026:98060 |
| Rocky Linux 10 | nodejs26-npm | 1:11.19.1-1.26.8.2.1.el10_3 | RLSA-2026:98060 |
| Rocky Linux 9 | nodejs | 1:22.23.2-2.module+el9.8.0+40374+17512296 | RLSA-2026:76750 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-1.module+el9.8.0+40263+faa47049 | RLSA-2026:97855, RLSA-2026:76750, RLSA-2026:73838 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:97855, RLSA-2026:96226, RLSA-2026:76750 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:75870, RLSA-2026:74085 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:75870, RLSA-2026:74085 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.2-1.amzn2023.0.3 | ALAS2023-2026-3123 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.8-1.22.23.2.1.amzn2023.0.3 | ALAS2023-2026-3123 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.21.0-1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.0-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.1.amzn2023.0.3 | ALAS2023-2026-3123 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.amzn2023.0.1 | ALAS2023-2026-3107 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.2-3.0.1.el10_2 | ELSA-2026-75864 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.8-1.22.23.2.3.0.1.el10_2 | ELSA-2026-75864 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.21.0-1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.2-2.module+el9.8.0+91062+a7d6b802 | ELSA-2026-96226, ELSA-2026-76750, ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+91010+e0f4f255 | ELSA-2026-96226, ELSA-2026-76750, ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96226, ELSA-2026-76750, ELSA-2026-73838 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.2.2.module+el9.8.0+91062+a7d6b802 | ELSA-2026-96226, ELSA-2026-76750, ELSA-2026-73838 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el9.8.0+91062+a7d6b802 | ELSA-2026-76750 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-96226, ELSA-2026-73838 |
| Oracle Linux 8 | nodejs +4 | 1:22.23.2-2.module+el8.10.0+91061+02523cc0 | ELSA-2026-75870, ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-75870, ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+91061+02523cc0 | ELSA-2026-75870, ELSA-2026-74085 |
| Oracle Linux 8 | npm | 1:10.9.8-1.22.23.2.2.module+el8.10.0+91061+02523cc0 | ELSA-2026-75870, ELSA-2026-74085 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module+el8.10.0+91061+02523cc0 | ELSA-2026-75870 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.139.1-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r11 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
| Wolfi rolling | renovate | 44.131.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 6.7.0, < 6.28.1 | 6.28.1 | GHSA-rfgv-xxqx-mfg5 |
| npm | undici | >= 7.0.0, < 7.29.1 | 7.29.1 | GHSA-rfgv-xxqx-mfg5 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 | GHSA-rfgv-xxqx-mfg5 |
Advisories 40
- RHSA-2026:97855 Red Hat Security Advisory: nodejs:26 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98060 Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71017 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:66605 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:66008 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98060 Important: nodejs26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3640 Red Hat Enterprise Linux (undici-nodejs): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:97855 Important: nodejs:26 security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ALSA-2026:76750 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75864 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75870 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:84589 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:84703 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76750 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:75870 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:75864 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74085 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73838 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73428 Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-76750 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 11, 2026
- ELSA-2026-75870 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 11, 2026
- RLSA-2026:76750 Important: nodejs:22 security update Rocky Linux Security Advisories · Oct 8, 2026
- RLSA-2026:75864 Important: nodejs22 security update Rocky Linux Security Advisories · Oct 6, 2026
- RLSA-2026:75870 Important: nodejs:22 security update Rocky Linux Security Advisories · Oct 6, 2026
- ELSA-2026-75864 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 6, 2026
- ELSA-2026-74085 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 2, 2026
- RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- ELSA-2026-73838 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ELSA-2026-73428 Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ALAS2023-2026-3107 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- ALAS2023-2026-3123 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026