Skip to main content

undici EUVDEUVD-2026-71465

| CVE-2026-85014 HIGH
Uncaught Exception (CWE-248)
2026-09-04 openjs GHSA-rx4f-c7p8-82vq
Denial Of Service Node.js Undici
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure client to attacker WebSocket server
  2. Delivery
    Complete WebSocket upgrade
  3. Exploit
    Abruptly close TCP without close handshake
  4. Execution
    undici aborts locked writable stream
  5. Persist
    Unhandled TypeError rejection
  6. Impact
    Node.js process terminates (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-248
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
Exploitation Conditions

The victim client application must use undici's experimental WebSocketStream client and hold a writer on its writable stream (the normal way to write), and must connect to a server the attacker controls or can MITM. The attacker (acting as that server) then simply closes the TCP connection abruptly without sending a WebSocket close handshake; undici unconditionally calls abort() on the locked writable and discards the returned promise, whose TypeError rejection is never observed and triggers Node's default unhandled-rejection process termination. No authentication and no user interaction are required (PR:N/UI:N). The primary limiting factor is the experimental, non-default WebSocketStream API - services that do not use WebSocketStream, or that do not connect to untrusted WebSocket endpoints, are not exposed; impact is limited to process crash (A:H only, C:N/I:N).
Impact

Signals are consistent and point to a genuine but bounded denial-of-service issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is well-calibrated for CWE-248 (uncaught exception): a network-reachable, unauthenticated, no-interaction trigger with pure availability impact and no confidentiality or integrity loss. Corroborating signals lower the urgency: EPSS is only 0.35% (28th percentile), there is no CISA KEV listing and no public POC identified, and SSVC reads Exploitation:none / Automatable:no / Technical Impact:partial. The one nuance is that raw AC:L understates a real deployment gate - exploitation only matters if the client application actually uses undici's *experimental* WebSocketStream client and holds a writer on the writable stream, which is uncommon in production. No signals conflict; there is no evidence of active exploitation. Net: treat as a routine-priority patch (crash-only DoS) for any service that uses WebSocketStream against untrusted servers, not a drop-everything incident.
Exploit ScenarioDerived

A Node.js service uses undici's experimental WebSocketStream client to connect to a third-party or attacker-controlled WebSocket server. The malicious server accepts the connection and then abruptly closes the underlying TCP socket with no WebSocket close handshake, causing undici to abort a locked writable stream whose rejected TypeError promise goes unobserved and terminates the Node process. No authentication, user interaction, or application bug is required, and no public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.

RemediationAI

Vendor-released patch: upgrade undici to 7.29.1 or 8.10.2 (the fix is in the 7.x and 8.x maintenance lines respectively), per GitHub Security Advisory GHSA-rx4f-c7p8-82vq and the OpenJS CNA advisory list; Red Hat consumers should additionally apply RHSA-2026:54389, RHSA-2026:54438 and RHSA-2026:66008 as applicable to their packaged runtime. If immediate upgrade is not possible, the most effective compensating control is to stop using the experimental WebSocketStream API in code paths that talk to untrusted or attacker-influenceable servers and switch to the stable WebSocket client, accepting the cost of rewriting the stream-based integration; alternatively, restrict outbound WebSocket connectivity to allow-listed endpoints so an attacker cannot position themselves as the peer that aborts the TCP connection, which does not help against server compromise or MITM but removes the trivial remote trigger. Running Node.js with a non-default unhandled-rejection mode (for example --unhandled-rejections=warn or a custom process-level unhandledRejection handler that does not exit) will keep the process alive through the rejected abort() promise, but this is a broad, process-wide change that suppresses every unhandled rejection and can mask unrelated defects and leak inconsistent state, so it should be treated only as a stopgap on top of a supervised/auto-restarting process rather than as a fix. Note that EPSS is 0.35% (28th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, so remediation can be scheduled on a normal patch cycle rather than as an emergency, prioritizing internet-facing services that use WebSocketStream.

Affected VersionsENISA

undici 7.0.0 <7.29.1
undici 8.0.0 <8.10.2

Affected Packages

npm undici fix: 7.29.1, 8.10.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

undici is the HTTP/1.1 client that underpins Node.js' built-in fetch and is also consumed directly as an npm library, and this flaw lives in its optional, non-default WebSocketStream implementation, which layers the WHATWG Streams API over a WebSocket connection. Per the WHATWG Streams specification, a WritableStream that is locked by a writer returns a promise from abort() that rejects with a TypeError because the lock prevents the underlying sink from being closed cleanly; undici's TCP socket-close handler invokes abort() on that locked writable regardless of lock state and does not attach a handler to, or await, the returned promise. Because the consuming application necessarily holds the writer (the only supported way to write to the stream), nothing else ever observes the rejection, and Node.js' default unhandled-rejection policy for rejected promises terminates the process. This is the classic CWE-248 uncaught-exception class: unhandled asynchronous errors escaping to the runtime rather than being converted into an observable stream error or a caught rejection, converting a benign network event (an unclean peer disconnect) into a full availability loss. The CPE cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:* reflects that undici is distributed both as a standalone package and as a vendored dependency inside downstream runtimes and platform images, so patched-version tracking has to cover both the npm package and any redistributors - the Red Hat errata in the references indicate the library is shipped in supported Red Hat products. Note the risk is narrow in practice: only code paths that instantiate WebSocketStream (not the stable WebSocket/ws client) and connect to attacker-influenced endpoints are reachable, and the outcome is denial of service only - no confidentiality or integrity impact per the assessed vector.

Know when Undici gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Untrusted server crashes an unauthenticated client with a single abrupt disconnect (AV:N/AC:L/PR:N/UI:N); crash-only impact gives A:H with C:N/I:N, matching the vendor vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.9 MEDIUM

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Sep 15, 2026 - 14:27 vuln.today
v2 - CVSS changed
Severity Changed
Sep 15, 2026 - 14:22 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 14:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch available
Sep 04, 2026 - 18:03 EUVD
CVE Published
Sep 04, 2026 - 16:30 cve.org
MEDIUM 5.9

DescriptionNVD

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

Technical POC Analysis

Source: GHSA-rx4f-c7p8-82vq (nodejs/undici), CWE-248 (Uncaught Exception) plus CWE-754.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

A high-severity availability flaw in the undici HTTP client for Node.js can crash affected services that use its experimental WebSocketStream API when an attacker-controlled or man-in-the-middle WebSocket connection is abruptly terminated. Because exploitation is unauthenticated and requires no user interaction, any exposed service using the affected undici versions may experience process termination and service disruption, though impact is limited to availability and to deployments that actually use the experimental WebSocketStream feature. No public exploit has been identified at time of analysis, a vendor patch is available, and leadership should prioritize inventory and upgrade of affected Node.js applications to reduce operational risk.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.4%
Top 72% exploitable
Prevalence
High
undici is Node.js's bundled HTTP client, but vulnerable code is an experimental WebSocketStream feature
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-109383 CRITICAL POC
9.1 Oct 15

Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
CVE-2026-109829 CRITICAL POC
9.1 Oct 15

Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2026-62909 HIGH POC
7.8
CVE-2026-82410 HIGH POC
8.7
CVE-2023-0790 HIGH POC
8.8
CVE-2026-53530 HIGH POC
8.7
CVE-2026-61544 HIGH POC
8.2
CVE-2024-34363 HIGH POC
7.5
CVE-2026-62985 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:54389 ADVISORY https://access.redhat.com/errata/RHSA-2026:54438 ADVISORY https://access.redhat.com/errata/RHSA-2026:66008 ADVISORY https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349 ADVISORY https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7 ADVISORY https://github.com/nodejs/undici/releases/tag/v7.29.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v8.10.2 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-85014 ADVISORY https://vuldb.com/vuln/399081 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy