SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-85014

MEDIUM · CVSS 5.9 EPSS 0.37% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The undici WebSocketStream client is vulnerable to a crash when a remote peer unexpectedly closes the TCP connection without performing a proper WebSocket close handshake, leading to an unhandled promise rejection that terminates the Node.js process. This issue affects undici versions 7.0.0 to 7.29.1 and 8.0.0 to 8.10.2, allowing untrusted servers to disrupt client applications without authentication. Developers and organizations using these versions should prioritize upgrading to undici 7.29.1 or 8.10.2 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-85014
Severity
MEDIUM
CVSS
5.9
EPSS
0.37%

Original NVD Description

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Related CVEs

Other vulnerabilities affecting the same vendor(s)