CVE-2026-85014 in undici
Summary
by MITRE • 09/04/2026
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in the undici library represents a critical reliability flaw within its experimental WebSocketStream client implementation, specifically affecting Node.js processes that utilize this module for real-time communication. The core issue arises from an improper handling of unclean TCP connection closures where the remote peer terminates the socket without performing the standard WebSocket close handshake. In such scenarios, the internal socket-close handler attempts to abort the writable stream associated with the WebSocket connection. This operation is performed unconditionally and, critically, the resulting promise returned by the abort method is discarded rather than awaited or handled.
This design oversight violates fundamental principles of asynchronous error handling in JavaScript environments governed by the WHATWG Streams standard. According to this specification, attempting to abort a writable stream that is currently locked results in a rejected promise containing a TypeError. Since the application code typically holds a reference to the writer instance as the exclusive mechanism for sending data over the WebSocket connection, the stream remains locked during normal operation. Consequently, when undici triggers the abort sequence due to the network disconnect, it generates an unhandled rejection that is never observed by any catch block or promise handler within the user's application logic.
The operational impact of this flaw is severe and deterministic for affected systems. Node.js maintains a default behavior where any unhandled promise rejection results in the immediate termination of the entire process to prevent potential data corruption or undefined states. Therefore, an attacker controlling or manipulating the remote server can trigger a Denial of Service condition with minimal effort. By simply closing the TCP connection abruptly without sending the proper WebSocket close frame, the malicious peer forces undici into this error path, causing the victim's Node.js application to crash instantly. This attack requires no authentication and exploits no misconfiguration on the client side, making it a highly accessible vector for service disruption against any system running vulnerable versions of undici that rely on WebSocketStream functionality.
From a classification perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, as the abrupt closure leads to process termination effectively consuming all available resources associated with the application instance. It also relates to CWE-755 Improper Handling of Unexpected Condition, specifically regarding the failure to handle an exceptional state resulting from a network event gracefully. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Denial of Service (T1499) by exploiting software logic errors rather than resource exhaustion through volume, allowing for efficient service disruption against targeted infrastructure.
The vulnerability impacts specific version ranges of the undici library, namely versions 7.0.0 through 7.29.1 and versions 8.0.0 through 8.10.2. These releases contain the flawed logic in their WebSocketStream implementation that fails to properly manage the lifecycle promises associated with stream abortion during network failures. To mitigate this risk, organizations must upgrade undici to version 7.29.1 or higher for the v7 branch, and version 8.10.2 or higher for the v8 branch. These patched versions address the unhandled rejection issue by ensuring that abort operations on locked streams are either handled correctly or structured in a way that prevents the propagation of fatal errors to the Node.js runtime environment. Until such upgrades are implemented, applications relying on this functionality remain susceptible to remote crashes triggered by simple network anomalies or malicious intent.