WebSocketStream Client Crash in Undici for Node.js by Independent Vendor

CVE-2026-85014

What is CVE-2026-85014?

A vulnerability exists in the undici's experimental WebSocketStream client, where a remote peer can crash the Node.js process by closing the TCP connection abruptly without a proper WebSocket close handshake. This problematic behavior stems from the internal socket-close handler, which calls abort on the writable stream unconditionally. As per the WHATWG Streams standard, this leads to unhandled promise rejections, resulting in the termination of the process. This issue affects undici versions 7.0.0 through 7.29.1, and 8.0.0 through 8.10.2. It's recommended that users upgrade to undici versions 7.29.1 or 8.10.2 to mitigate this vulnerability.

References