CVE-2026-85014

Aliases:DEBIAN-CVE-2026-85014UBUNTU-CVE-2026-85014CGA-3cq9-vxfx-r9vxCGA-v8vq-p6wv-2564
Advisory lineage Upstream: 0 Downstream: 3
Analyzed
Published: 04 Sept 2026, 16:30
Last modified:04 Sept 2026, 19:30

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.37% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Sept 2026, 16:30
Published
Vulnerability first disclosed
04 Sept 2026, 19:30
Last Modified
Vulnerability information updated

Description

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.37%• Percentile: 31%

Techniques & Countermeasures

  • CWE-248•Uncaught Exception

    An exception is thrown from a function, but it is not caught.

  • CWE-754•Improper Check for Unusual or Exceptional Conditions

    The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Affected Systems

  • chainguard•node-gyp

    all | < 13.0.2-r1

  • wolfi•node-gyp

    all | < 13.0.2-r1

  • debian•node-undici

    all | all | all | < 8.10.2+dfsg+~cs3.2.2-1

  • ubuntu•node-undici

    all | all

  • nodejs•undici

    ≥ 7.0.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2

  • undici•undici

    ≥ 7.0.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2

References (5)