CVE-2026-85014: undici WebSocketStream DoS Vulnerability

CVE-2026-85014 Overview

CVE-2026-85014 is a denial-of-service vulnerability in the experimental WebSocketStream client of undici, the HTTP/1.1 client used by Node.js. A remote peer can terminate a TCP connection without a WebSocket close handshake and crash the entire Node.js process. The flaw affects undici versions 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1. Exploitation requires no authentication and no application-level mistake by the client. The issue is tracked under [CWE-248: Uncaught Exception] and stems from an unhandled promise rejection during socket close handling.

Critical Impact
An untrusted WebSocket server can terminate any connecting Node.js client process with a single abrupt TCP disconnect, enabling unauthenticated remote denial of service.

Affected Products

undici versions 7.0.0 through 7.29.0
undici versions 8.0.0 through 8.10.1
Node.js applications using the experimental WebSocketStream API from undici

Discovery Timeline

2026-09-04 - CVE-2026-85014 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85014

Vulnerability Analysis

The vulnerability resides in the internal socket-close handler of undici's experimental WebSocketStream client. When the remote peer closes the TCP connection without a WebSocket close handshake, the handler calls abort on the underlying writable stream and discards the returned promise. Under the WHATWG Streams specification, aborting a writable stream that has an active writer returns a promise that rejects with a TypeError. Because applications must hold a writer to send data, the writable is always locked in practice. The rejection is never observed, and Node.js applies its default unhandled-rejection behavior, which terminates the process. This turns a routine transport-layer event into a full process crash.

Root Cause

The root cause is an unhandled promise rejection [CWE-248] in the close path. The handler treats abort as fire-and-forget, but the standard-mandated TypeError rejection propagates to the Node.js runtime. Node.js escalates unhandled rejections to process termination by default in current releases.

Attack Vector

Any remote WebSocket server the client connects to can trigger the crash. The attacker completes the WebSocket upgrade, then closes the TCP socket abruptly without sending a WebSocket close frame. No credentials, prior state, or user interaction are required. The attack is network-reachable and can be repeated against every reconnect attempt, denying service to clients that automatically retry.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-rx4f-c7p8-82vq for the maintainer-supplied technical description.

Detection Methods for CVE-2026-85014

Indicators of Compromise

Unexpected Node.js process exits shortly after outbound WebSocket connections terminate.
Runtime logs containing UnhandledPromiseRejection with a TypeError referencing a locked writable stream.
Repeated crash-restart cycles in services that use WebSocketStream against third-party endpoints.

Detection Strategies

Inventory Node.js services and identify dependencies on undici 7.0.0–7.29.0 or 8.0.0–8.10.1 using npm ls undici or software composition analysis tooling.
Search source repositories for imports of WebSocketStream from undici to locate at-risk code paths.
Correlate process-exit telemetry with outbound TCP resets on WebSocket ports (443, 80, custom).

Monitoring Recommendations

Alert on Node.js exit codes tied to unhandled rejections in production workloads.
Track undici versions across container images and serverless runtimes through SBOM ingestion.
Monitor for anomalous outbound WebSocket peers that consistently trigger abrupt disconnects.

How to Mitigate CVE-2026-85014

Immediate Actions Required

Upgrade undici to version 7.29.1 on the 7.x branch or 8.10.2 on the 8.x branch.
Audit application code for use of the experimental WebSocketStream API and restrict connections to trusted servers until patched.
Rebuild and redeploy container images and Lambda layers that bundle vulnerable undici versions.

Patch Information

The maintainers released fixed versions 7.29.1 and 8.10.2. Refer to the GitHub Security Advisory GHSA-rx4f-c7p8-82vq and the OpenJS Foundation Security Advisories for release details.

Workarounds

Avoid the experimental WebSocketStream client and use undici's stable WebSocket implementation until the upgrade is deployed.
Add a global process.on('unhandledRejection') handler that logs and suppresses the specific TypeError from stream abort, understanding this masks other rejections.
Restrict outbound WebSocket destinations to allow-listed, trusted endpoints via egress firewall rules.

bash

# Configuration example
npm install undici@8.10.2
# or for the 7.x line
npm install undici@7.29.1
npm ls undici