CVE-2026-85014

What it is

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-04 17:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-15 14:09 UTC Last updatedMost recent change to the record

Details

Published

2026-09-04 17:17 UTC

Last modified

2026-09-15 14:09 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-248

Record status

Analyzed

Affected

• Nodejs Undici < 7.29.1
• Nodejs Undici < 8.10.2

Attack profile CVSS 3.1 · 5.9

Attack vector

Network

Complexity

High

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High