Detections
Analytics

Echo: undici: security update to 6.28.1

high Tenable Cloud Security Plugin ID 472810

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server
 responds with a subprotocol that the client never requested. A default WebSocket connection sends no
 subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici
 dereferences a null value while checking it against the requested list and throws an uncaught TypeError.
 Because that code runs inside a microtask with no surrounding error handling, the exception propagates and
 terminates the process under Node's default behavior, instead of gracefully failing the connection as
 required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or
 compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed
 remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up
 to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1,
 7.29.1, or 8.10.2. (CVE-2026-19534)

Solution

Update the undici library and its related packages to version 6.28.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-19534

Plugin Details

Severity: High

ID: 472810

Version: Revision 1.1

Type: Local

Published: 10/5/2026

Updated: 10/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-19534

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/5/2026

Vulnerability Publication Date: 9/4/2026

Reference Information

CVE: CVE-2026-19534

IAVB: 2026-B-0283