CVE-2026-19534: 
Grafana vulnerability analysis and mitigation

CVE-2026-19534 is a Denial of Service vulnerability in the undici WebSocket client that allows a remote, unauthenticated attacker to crash the entire Node.js process by responding with an unrequested Sec-WebSocket-Protocol header during the WebSocket opening handshake. The vulnerability was published on September 4, 2026, and affects undici versions 6.7.0–6.28.0, 7.0.0–7.29.0, and 8.0.0–8.10.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a NULL pointer dereference (CWE-476) combined with an uncaught exception (CWE-248) in undici's WebSocket handshake validation logic. When a server's 101 Switching Protocols response includes a Sec-WebSocket-Protocol header that the client never requested, undici attempts to validate the header against the client's requested subprotocol list — which is null in the default new WebSocket(url) usage — causing a TypeError to be thrown. This exception is raised inside a queueMicrotask callback with no surrounding try/catch, so it propagates as an uncaught exception and terminates the Node.js process rather than gracefully failing the connection as required by RFC 6455 section 4.1. The attack is exploitable over any network path where the attacker controls or can intercept the server response, including plaintext ws:// connections subject to machine-in-the-middle attacks (GitHub Advisory).

Successful exploitation results in a complete crash of the Node.js process hosting the vulnerable undici WebSocket client, causing a full denial of service with high availability impact. There is no confidentiality or integrity impact. Any application using undici's default WebSocket connection (without specifying a subprotocol) that connects to an attacker-controlled, compromised, or network-intercepted server is at risk, making this particularly dangerous in microservice architectures or applications that connect to third-party WebSocket endpoints over unencrypted connections (GitHub Advisory, Red Hat CVE).

The vulnerability is remotely exploitable with no authentication, no privileges, and no user interaction required, and has been assessed as automatable by NVD SSVC analysis. As of the disclosure date, no in-the-wild exploitation has been reported and no public proof-of-concept exploit code is known. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Identify a target: Find a Node.js application that uses undici (versions 6.7.0–6.28.0, 7.0.0–7.29.0, or 8.0.0–8.10.1) to open a WebSocket connection, particularly one using the default new WebSocket(url) call without specifying a subprotocol.
2. Position for attack: Either control the WebSocket server the target connects to, compromise it, or perform a machine-in-the-middle attack on a plaintext ws:// connection (e.g., via ARP spoofing or DNS poisoning on the same network segment).
3. Craft a malicious 101 response: When the target client initiates a WebSocket handshake, respond with a valid HTTP 101 Switching Protocols response that includes a Sec-WebSocket-Protocol header with any subprotocol value (e.g., Sec-WebSocket-Protocol: chat), even though the client never requested one.
4. Trigger the crash: The undici client dereferences a null value while attempting to validate the unrequested subprotocol against the client's (empty) requested list, throwing an uncaught TypeError inside a queueMicrotask callback, which terminates the Node.js process and causes a denial of service (GitHub Advisory).

• Logs: Abrupt Node.js process termination with an uncaught TypeError referencing WebSocket subprotocol validation in undici stack traces; crash logs showing errors in queueMicrotask callbacks during WebSocket handshake.
• Network: Unexpected Sec-WebSocket-Protocol headers in server 101 responses to clients that did not request a subprotocol; anomalous WebSocket handshake responses from servers the application connects to.
• Process: Sudden, unexplained termination of Node.js processes coinciding with WebSocket connection attempts; process restart loops if a supervisor (e.g., PM2, systemd) is configured to auto-restart the application.

Users should upgrade undici to the patched versions: 6.28.1, 7.29.1, or 8.10.2. No configuration-based workaround is available — the fix must be applied through an upgrade. As an additional defensive measure, applications should avoid connecting to untrusted WebSocket servers over plaintext ws:// connections, preferring wss:// to reduce exposure to machine-in-the-middle attacks (GitHub Advisory, Red Hat CVE).

The vulnerability was published by maintainer mcollina via the GitHub Security Advisory GHSA-rfgv-xxqx-mfg5, with remediation review credited to UlisesGascon. Red Hat has acknowledged the vulnerability and is tracking it under Bugzilla #2528759, noting a preliminary CVSS score consistent with the upstream assessment. No significant broader community or media commentary has been identified at this time (GitHub Advisory, Red Hat CVE).