Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-85014 EUVD-2026-71465GHSA-rx4f-c7p8-82vq

undici vulnerable to Denial of Service via WebSocketStream unclean close

Published Sep 4, 2026 · Updated Sep 4, 2026 · Assigned by openjs

Description

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Affected products

VendorProductAffectedFixed
undici undici 7.0.0 – < 7.29.1, 8.0.0 – < 8.10.2 7.29.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-undici 8.10.2+dfsg+~cs3.2.2-1 —
Debian 13 node-undici No fix yet —
Debian 12 node-undici No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-undici No fix yet —
Ubuntu 26.04 LTS node-undici No fix yet —
Ubuntu 24.04 LTS node-undici No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.2.hum1 RHSA-2026:66008
Red Hat Hardened Images 1 nodejs24 +6 24.18.1-0.2.2.hum1 RHSA-2026:54438
Red Hat Hardened Images 1 nodejs24-npm 11.16.0-1.24.18.1.0.2.2.hum1 RHSA-2026:54438
Red Hat Hardened Images 1 nodejs26 +6 26.7.0-1.5.2.hum1 RHSA-2026:54389
Red Hat Hardened Images 1 nodejs26-npm 11.19.0-1.26.7.0.1.5.2.hum1 RHSA-2026:54389
Red Hat Hardened Images 1 v8-14.6-devel 14.6.202.34-1.26.7.0.1.5.2.hum1 RHSA-2026:54389
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 pi-coding-agent 1.0.4-bp160.1.1 openSUSE-SU-2026:22111-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling code-server 4.139.1-r2 —
Wolfi rolling lerna 10.0.1-r11 —
Wolfi rolling node-gyp 13.0.2-r1 —
Wolfi rolling prism 5.16.0-r14 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm undici >= 7.0.0, < 7.29.1 7.29.1 GHSA-rx4f-c7p8-82vq
npm undici >= 8.0.0, < 8.10.2 8.10.2 GHSA-rx4f-c7p8-82vq

Advisories 5

References