# CVE-2026-85014: undici WebSocketStream denial of service via unclean close

Source: https://junglewise.ai/threats/cve-2026-85014-undici-websocketstream-denial-of-service-via-unclean-close  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85014 · Severity: medium · CVSS 5.9 · Published 2026-09-04

undici is a popular HTTP client library for Node.js. Its experimental WebSocketStream feature can crash the entire Node.js process if a remote server abruptly closes the TCP connection without following the proper WebSocket close protocol. An untrusted or compromised server can exploit this to cause a denial of service with no authentication or special setup required.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-85014 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85014 being exploited in the wild.

**How severe is CVE-2026-85014?** Medium severity, with a CVSS score of 5.9, published 4 September 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.1.

**Is there a fix for CVE-2026-85014?** Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85014 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85014?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 7.29.1 or later

  ```sh
  npm install undici@7.29.1
  ```


## Technical details

This is an unhandled promise rejection vulnerability in undici's WebSocketStream implementation. When a remote peer closes the TCP connection without sending a proper WebSocket close frame, the internal socket-close handler unconditionally calls abort() on the writable stream. Per the WHATWG Streams standard, aborting a locked writable stream (which is the case when an application holds a writer) returns a rejected promise with a TypeError. The handler discards this promise without awaiting or handling it, resulting in an unobserved rejection. Node.js's default unhandledRejection behavior terminates the process. Attack requires network reachability to the WebSocket server; no authentication or user interaction is required. The fix involves properly handling the promise returned by abort().

## Affected products

- OpenJS Foundation undici >=7.0.0, <7.29.1; >=8.0.0, <8.10.2

## Identifiers

- CVE-2026-85014
- GHSA-rx4f-c7p8-82vq

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: patched: Patched in undici 7.29.1 and 8.10.2

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)