Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2026-85014 — undici

MEDIUMFix: nodejs/undici@1858656

CVE-2026-85014 is a medium-severity (CVSS 5.9) CWE-248 vulnerability in undici. A fix is available for undici — see the affected versions and patch details below.

undici vulnerable to Denial of Service via WebSocketStream unclean close

Also known asGHSA-rx4f-c7p8-82vq
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-85014.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk
0.00%0.29%0.58%0.87%0.4%0.4%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-85014 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

9Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
undicinpm
143.8Mdownloads / week

Description

Impact

undici's WebSocketStream crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls abort() on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a TypeError, and the handler discards that promise. The unobserved rejection surfaces as an unhandledRejection and, under Node.js's default behavior, terminates the process.

A malicious or compromised WebSocket server can crash a client with a single connection teardown (a TCP reset, a proxy teardown, or a protocol-violating frame). Affected applications are those using the WebSocketStream API and writing through a writer, which is the standard way to write.

All releases from undici 7.0.0 are affected. WebSocketStream was introduced in 7.0.0.

Patches

Upgrade to undici v7.29.1 or v8.10.2.

Workarounds

No workaround is available.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmundici≥ 7.0.0&&< 7.29.17.29.1npm install undici@7.29.1
📦npmundici≥ 8.0.0&&< 8.10.28.10.2npm install undici@8.10.2

Affected Products

1 product · 2 configurations
Application
undicinodejs
≥ 8.0.0 && < 8.10.2
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for undici, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update undici to 7.29.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-85014 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This Moderate impact flaw in the `undici` library's experimental `WebSocketStream` client can lead to a denial of service. An untrusted remote server can crash a vulnerable Node.js client application by abruptly closing a TCP connection without a WebSocket handshake. This affects the availability of applications…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Source: Red Hat security advisory for CVE-2026-85014 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Hardened Imagesnodejs26-main-11.19.0-1.26.7.0.1.5.2.hum1RHSA-2026:54389
Red Hat Hardened Imagesnodejs24-main-11.16.0-1.24.18.1.0.2.2.hum1RHSA-2026:54438
Red Hat Hardened Imagesgrafana12-4-main-12.4.10-0.2.hum1RHSA-2026:66008

Frequently Asked Questions

## Impact undici's `WebSocketStream` crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls `abort()` on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a `TypeError`, and the handler discards that promise. The unobserved rejection surfaces as an `unhandledRejection` and, under Node.js's default behavior, terminates the process. A malicious or compromised WebSocket serve
O3 Security · Impact-Aware SCA

Is CVE-2026-85014 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works