CVE-2026-85014
published 2026-09-04CVE-2026-85014: undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
29.5th percentile
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| grafana | grafana | — | — |
| nodejs | undici | >= 7.0.0 < 7.29.1 | 7.29.1 |
| nodejs | undici | >= 8.0.0 < 8.10.2 | 8.10.2 |
| nodejs_22 | nodejs | — | — |
| nodejs_24 | nodejs | — | — |
| nodejs_26 | nodejs | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift4 | ose-monitoring-plugin-rhel9 | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-lightspeed-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | — | — |
| rhdh | red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici vulnerable to Denial of Service via WebSocketStream unclean close
ghsa·2026-09-29
CVE-2026-85014 [MEDIUM] CWE-248 undici vulnerable to Denial of Service via WebSocketStream unclean close
undici vulnerable to Denial of Service via WebSocketStream unclean close
## Impact
undici's `WebSocketStream` crashes the client process when a WebSocket connection is closed abruptly without a close handshake. On such an unclean close, the internal socket-close handler calls `abort()` on the writable stream even when the application holds a writer lock. Per the WHATWG Streams standard, aborting a locked stream returns a promise that rejects with a `TypeError`, and the handler discards that promise. The unobserved rejection surfaces as an `unhandledRejection` and, under Node.js's default behavior, terminates the process.
A malicious or compromised WebSocket server can crash a client with a single connection teardown (a TCP reset, a proxy teardown, or a protocol-violating frame). Affecte
Red Hat
undici: undici: Denial of Service via WebSocketStream unclean close
vendor_redhat·2026-09-04·CVSS 5.9
CVE-2026-85014 [MEDIUM] CWE-390 undici: undici: Denial of Service via WebSocketStream unclean close
undici: undici: Denial of Service via WebSocketStream unclean close
A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: openshift-pipelines/pipelines-console-plugin-pf5-rhel9 (OpenShift Pipelines) - Fix deferred
Package: openshift-pipelines/pipelines-console-plugin-rhel9 (OpenShift Pipelines) - Fix deferred
Package: amq-broker-bin.zip (Red Hat AMQ Broker 7) - Fix deferred
Package: amq-br
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85014 nodejs24: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-85014 [MEDIUM] CVE-2026-85014 nodejs24: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
CVE-2026-85014 nodejs24: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which
Bugzilla
CVE-2026-85014 fbthrift: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-85014 [MEDIUM] CVE-2026-85014 fbthrift: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
CVE-2026-85014 fbthrift: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which
Bugzilla
CVE-2026-85014 nodejs20: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-85014 [MEDIUM] CVE-2026-85014 nodejs20: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
CVE-2026-85014 nodejs20: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which
Bugzilla
CVE-2026-85014 nodejs22: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
bugzilla·2026-09-09·CVSS 5.9
CVE-2026-85014 [MEDIUM] CVE-2026-85014 nodejs22: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
CVE-2026-85014 nodejs22: undici: Denial of Service via WebSocketStream unclean close [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which
Bugzilla
CVE-2026-85014 undici: undici: Denial of Service via WebSocketStream unclean close
bugzilla·2026-09-04·CVSS 5.9
CVE-2026-85014 [MEDIUM] CVE-2026-85014 undici: undici: Denial of Service via WebSocketStream unclean close
CVE-2026-85014 undici: undici: Denial of Service via WebSocketStream unclean close
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and n
2026-09-04
Published