{"id":"CVE-2026-85014","aliases":["GHSA-rx4f-c7p8-82vq"],"url":"https://o3.security/vulnerability/CVE-2026-85014","summary":"undici vulnerable to Denial of Service via WebSocketStream unclean close","details":"## Impact\n\nundici's `WebSocketStream` crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls `abort()` on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a `TypeError`, and the handler discards that promise. The unobserved rejection surfaces as an `unhandledRejection` and, under Node.js's default behavior, terminates the process.\n\nA malicious or compromised WebSocket server can crash a client with a single connection teardown (a TCP reset, a proxy teardown, or a protocol-violating frame). Affected applications are those using the `WebSocketStream` API and writing through a writer, which is the standard way to write.\n\nAll releases from undici 7.0.0 are affected. WebSocketStream was introduced in 7.0.0.\n\n## Patches\n\nUpgrade to undici v7.29.1 or v8.10.2.\n\n## Workarounds\n\nNo workaround is available.","published":"2026-09-04T16:30:07.996Z","modified":"2026-10-21T02:30:36.492115728Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"7.29.1"},{"ecosystem":"npm","name":"undici","fixedVersion":"8.10.2"}],"fix":{"url":"https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349","label":"nodejs/undici@1858656"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85014.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:36.492115728Z"}}