An unauthenticated remote denial-of-service vulnerability exists in the undici WebSocket client that allows attackers to terminate the Node.js process by sending a malformed protocol response.

This is an uncaught exception (CWE-248) occurring during the WebSocket opening handshake when an unauthenticated attacker provides a subprotocol header that the client did not request. The resulting null pointer dereference triggers an unhandled exception in a microtask, causing the entire application process to terminate.

Successful exploitation of this vulnerability results in a complete denial-of-service for the affected Node.js application. With a CVSS score of 7.5, the risk is high because the vulnerability is network-exploitable without authentication and can be triggered by any server the application connects to, including malicious or machine-in-the-middle compromised endpoints. This leads to significant service availability disruption and operational downtime.

Immediate Action: Update the undici package to version 6.28.1, 7.29.1, or 8.10.2 immediately to incorporate the necessary error handling fixes.

Proactive Monitoring: Monitor application logs for frequent process restarts or unexpected termination events that may indicate exploitation attempts against WebSocket connections.

Compensating Controls: Ensure that outbound WebSocket connections are restricted to trusted, verified endpoints and employ transport-layer security (TLS) to mitigate the risk of machine-in-the-middle attacks injecting malicious subprotocol headers.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease with which an unauthenticated attacker can trigger a process crash, organizations must prioritize the application of the patched versions of undici. Failure to update leaves production services vulnerable to remote denial-of-service attacks that require no specific user interaction or authentication.