CVE-2026-85014 undici CVE debrief

Who should care

Node.js developers and administrators using the undici library, especially those with applications relying on WebSocket functionality, should assess exposure and upgrade to undici 7.29.1 or 8.10.2 to prevent potential crashes.

Why it matters

CVE-2026-85014 affects undici's WebSocketStream client, potentially causing Node.js process crashes. Developers and administrators should assess exposure, verify affected versions, and upgrade to undici 7.29.1 or 8.10.2 to prevent crashes. The vulnerability allows an untrusted server to crash a client with a single abrupt disconnect, with no authentication required.

• Potential Node.js process crashes due to unclean WebSocket connection closures
• Need to verify and upgrade affected undici versions to prevent crashes
• Possible impact on application availability and reliability
• Requires review of Node.js application configurations and undici usage

Technical summary

The undici library's experimental WebSocketStream client crashes the Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. This occurs due to the internal socket-close handler calling abort on the writable stream unconditionally and discarding the returned promise, leading to Node's default unhandled-rejection behavior terminating the process. The vulnerability allows an untrusted server to crash a client with a single abrupt disconnect, with no authentication required. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2 to prevent Node.js process crashes due to unclean WebSocket connection.

Defensive priority

Upgrade to undici 7.29.1 or 8.10.2 to prevent Node.js process crashes due to unclean WebSocket connection closures.

Recommended defensive actions

• Upgrade to undici 7.29.1 or 8.10.2
• Review and update affected Node.js applications using undici
• Monitor Node.js process stability in environments using undici
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in undici's WebSocketStream client, which causes Node.js process crashes when a remote peer closes the TCP connection without a WebSocket close handshake.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.