Is CVE-2026-85014 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85014 being exploited in the wild.

How severe is CVE-2026-85014?

Medium severity, with a CVSS score of 5.9, published 4 September 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.1.

Is there a fix for CVE-2026-85014?

Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85014 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85014?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85014: undici WebSocketStream denial of service via unclean close

CVE-2026-85014 · Severity: medium · CVSS 5.9 · Published 2026-09-04

undici is a popular HTTP client library for Node.js. Its experimental WebSocketStream feature can crash the entire Node.js process if a remote server abruptly closes the TCP connection without following the proper WebSocket close protocol. An untrusted or compromised server can exploit this to cause a denial of service with no authentication or special setup required.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-85014 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85014 being exploited in the wild.
How severe is CVE-2026-85014?: Medium severity, with a CVSS score of 5.9, published 4 September 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.1.
Is there a fix for CVE-2026-85014?: Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85014 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85014?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 7.29.1 or later
```
npm install undici@7.29.1
```

Technical details

This is an unhandled promise rejection vulnerability in undici's WebSocketStream implementation. When a remote peer closes the TCP connection without sending a proper WebSocket close frame, the internal socket-close handler unconditionally calls abort() on the writable stream. Per the WHATWG Streams standard, aborting a locked writable stream (which is the case when an application holds a writer) returns a rejected promise with a TypeError. The handler discards this promise without awaiting or handling it, resulting in an unobserved rejection. Node.js's default unhandledRejection behavior terminates the process. Attack requires network reachability to the WebSocket server; no authentication or user interaction is required. The fix involves properly handling the promise returned by abort().

Affected products

OpenJS Foundation undici >=7.0.0, <7.29.1; >=8.0.0, <8.10.2

Identifiers

CVE-2026-85014
GHSA-rx4f-c7p8-82vq

Timeline

2026-09-04: disclosed
2026-09-04: patched: Patched in undici 7.29.1 and 8.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.