CyberRota Analysis
AI-GeneratedThe undici WebSocketStream client is vulnerable to a crash when a remote peer unexpectedly closes the TCP connection without performing a proper WebSocket close handshake, leading to an unhandled promise rejection that terminates the Node.js process. This issue affects undici versions 7.0.0 to 7.29.1 and 8.0.0 to 8.10.2, allowing untrusted servers to disrupt client applications without authentication. Developers and organizations using these versions should prioritize upgrading to undici 7.29.1 or 8.10.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)