Most recent entries from all

certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1233

Withdrawn: CLEANSTART-2026-EC11110 — undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier pa…

Withdrawn by the publisher.

Affected: CleanStart: apache-superset

Multiple security vulnerabilities affect the apache-superset package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual vulnerability details.

fkie_cve-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

GHSA-rfgv-xxqx-mfg5 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

Affected: npm: undici

### Impact

The undici WebSocket client throws an uncaught `TypeError` during the opening handshake when a server's `101` response includes a `Sec-WebSocket-Protocol` header that the client never requested. The throw occurs in a `queueMicrotask` callback with no surrounding `try`/`catch`, so it propagates as an uncaught exception and terminates the Node.js process. This is a remote, unauthenticated denial of service against any application that opens a WebSocket to an attacker controlled or compromised server, or over a plaintext `ws://` connection subject to a machine-in-the-middle. It affects the default `new WebSocket(url)` usage, where no subprotocol is requested. Per RFC 6455 section 4.1, an unrequested subprotocol must fail the connection, not crash it.

All releases starting at undici 6.7.0 are affected.

### Patches

Upgrade to undici 6.28.1, 7.29.1, or 8.10.2.

### Workarounds

No workaround is available. The fix must be applied through an upgrade.

RHSA-2026:66008 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

grafana: Grafana: Session takeover via Auth Proxy cache key collision undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: HTTP response splitting via retry interceptor undici: undici: Denial of Service via unrequested WebSocket subprotocol grafana: Grafana: Unauthorized public dashboard deletion across organizations undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close

UBUNTU-CVE-2026-19534

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici