Description
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 7.0.0 – < 7.29.1, 8.0.0 – < 8.10.2 | 7.29.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.2.hum1 | RHSA-2026:66008 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.1-0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.1.0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.7.0-1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.19.0-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.139.1-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r11 | — |
| Wolfi rolling | node-gyp | 13.0.2-r1 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 7.0.0, < 7.29.1 | 7.29.1 | GHSA-rx4f-c7p8-82vq |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 | GHSA-rx4f-c7p8-82vq |
Advisories 5
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:54389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54438 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:66008 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026