Executive brief
undici is a popular HTTP client library for Node.js. Its experimental WebSocketStream feature can crash the entire Node.js process if a remote server abruptly closes the TCP connection without following the proper WebSocket close protocol. An untrusted or compromised server can exploit this to cause a denial of service with no authentication or special setup required.
Technical details
This is an unhandled promise rejection vulnerability in undici's WebSocketStream implementation. When a remote peer closes the TCP connection without sending a proper WebSocket close frame, the internal socket-close handler unconditionally calls abort() on the writable stream. Per the WHATWG Streams standard, aborting a locked writable stream (which is the case when an application holds a writer) returns a rejected promise with a TypeError. The handler discards this promise without awaiting or handling it, resulting in an unobserved rejection. Node.js's default unhandledRejection behavior terminates the process. Attack requires network reachability to the WebSocket server; no authentication or user interaction is required. The fix involves properly handling the promise returned by abort().
Affected products
- OpenJS Foundation undici >=7.0.0, <7.29.1; >=8.0.0, <8.10.2
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patched in undici 7.29.1 and 8.10.2