CVE-2026-85014Medium· 5.9▾ Sunlitundici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the wri…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.4%
undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
undici >= 7.0.0, < 7.29.1undici >= 8.0.0, < 8.10.2Upgrade past the affected range:
undici 8.10.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84947Low· 3.7undici's dump interceptor reads and discards a response body up to a configurable maximum size
CVE-2026-84890Medium· 5.9undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header
CVE-2026-18149Medium· 5.9undici's retry handler can leave an already-exposed response body pending forever
CVE-2026-85152High· 7.4undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool
CVE-2026-84961High· 7.4undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON
CVE-2026-19534High· 7.5undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested