undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-19534 · Microsoft / collected KEV context

EUVD-2026-71636

GHSA-rfgv-xxqx-mfg5

cve-program · CVE-2026-19534

• https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71636

• https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-19534

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5

osv · GHSA-rfgv-xxqx-mfg5

• https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5
• https://nvd.nist.gov/vuln/detail/CVE-2026-19534
• https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5
• https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728
• https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v6.28.1
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 11 Nov 2026
• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 9 Nov 2026
• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 7 Nov 2026
• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 5 Nov 2026
• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 1 Nov 2026
• undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101… · Advisory content revised · 30 Oct 2026
• Jira Software Data Center: DoS (Denial of Service) undici Dependency (CVE-2026-19534) · Security advisory · 20 Oct 2026