AIKIDO-2026-775839
undici is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
undiciTL;DR
The WebSocket client throws an uncaught TypeError during the opening handshake when a 101 response includes a Sec-WebSocket-Protocol header that the client never requested. The throw runs inside a queueMicrotask with no surrounding error handling, so it terminates the Node.js process. Default WebSocket usage requests no subprotocol, and an unrequested subprotocol must fail the connection rather than crash it. The fix rejects the unrequested subprotocol without throwing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you open a WebSocket connection.
Background info
undici is vulnerable to Denial of Service (DoS) in versions 6.7.0 - 6.28.0, 7.0.0 - 7.29.0 and 8.0.0 - 8.10.1.
How to fix this
Upgrade the undici library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.