fix(websocket): reject unrequested subprotocols

Guard the opening-handshake protocol check when the client did not request any subprotocols. Fail the WebSocket connection with protocol error 1002 instead of allowing a TypeError to escape from the response microtask and terminate the process.

Fixes: GHSA-rfgv-xxqx-mfg5
CVE: CVE-2026-19534
Signed-off-by: Matteo Collina <hello@matteocollina.com>

Author: mcollina

lib/web/websocket/connection.js

@@ -200,7 +200,7 @@ function establishWebSocketConnection (url, protocols, client, handler, options)
         // is specified, the server needs to include the same field and one of
         // the selected subprotocol values in its response for the connection to
         // be established.
-        if (!requestProtocols.includes(secProtocol)) {
+        if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
           failWebsocketConnection(handler, 1002, 'Protocol was not set in the opening handshake.')
           return
         }

test/websocket/opening-handshake.js

@@ -516,3 +516,36 @@ test('Server sends invalid Sec-WebSocket-Extensions header', { skip: runtimeFeat
     })
   })
 })
+
+test('Server sends Sec-WebSocket-Protocol header when no protocols were requested', { skip: runtimeFeatures.has('crypto') === false }, (t) => {
+  const uid = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11'
+
+  return new Promise((resolve, reject) => {
+    const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
+      const key = req.headers['sec-websocket-key']
+      t.assert.ok(key)
+      t.assert.strictEqual(req.headers['sec-websocket-protocol'], undefined)
+
+      const accept = require('node:crypto').hash('sha1', key + uid, 'base64')
+
+      res.setHeader('Upgrade', 'websocket')
+      res.setHeader('Connection', 'upgrade')
+      res.setHeader('Sec-WebSocket-Accept', accept)
+      res.setHeader('Sec-WebSocket-Protocol', 'chat') // <-- never requested
+      res.statusCode = 101
+
+      res.end()
+    }).listen(0, () => {
+      // No subprotocols requested, so the request omits Sec-WebSocket-Protocol.
+      const ws = new WebSocket(`ws://localhost:${server.address().port}`)
+
+      ws.onopen = reject
+
+      ws.addEventListener('error', ({ error }) => {
+        t.assert.ok(error)
+        server.close()
+        resolve()
+      })
+    })
+  })
+})