CVE-2026-85014

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake.

Undici

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is…

4. Sep 2026

Ausgewertete Quellen

• Hinweis
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-85014
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq