CVE-2026-85014

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. During an unclean close, the internal socket-close handler calls abort on the writable stream and discards the returned promise. According to the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError. Since the application holds a writer on that writable, the rejection is not observed, triggering Node's default unhandled-rejection behavior which terminates the process. This allows an untrusted server to cause a Denial of Service by abruptly disconnecting.

Recommendations Upgrade to version 7.29.1 for versions in the 7.x branch. Upgrade to version 8.10.2 for versions in the 8.x branch.