CVE-2026-85014: 
Grafana Analyse et atténuation des vulnérabilités

CVE-2026-85014 is a Denial of Service vulnerability in undici's experimental WebSocketStream client that causes the entire Node.js process to crash when a remote peer closes the TCP connection without completing a WebSocket close handshake. The flaw was disclosed on September 4, 2026, and affects undici versions 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1 (WebSocketStream was introduced in 7.0.0). It carries a CVSS v3.1 base score of 5.9 (Medium/Moderate) (GitHub Advisory, Red Hat CVE).

The root cause is an uncaught exception / unhandled promise rejection (CWE-248, CWE-754, CWE-390) in undici's internal socket-close handler. When an unclean TCP close occurs, the handler unconditionally calls abort() on the writable stream without awaiting or observing the returned promise. Per the WHATWG Streams standard, aborting a locked writable stream returns a promise that rejects with a TypeError; because the application holds a writer lock on that stream (the standard write path), the rejection is never observed. Node.js's default unhandled-rejection behavior then terminates the entire process. A malicious or compromised WebSocket server can trigger this with a single TCP reset, proxy teardown, or protocol-violating frame — requiring no authentication and no application-level mistake (GitHub Advisory).

Successful exploitation results in a complete availability loss of the affected Node.js process — the entire application is terminated, not just the WebSocket connection. There is no confidentiality or integrity impact. Any application using undici's WebSocketStream API and writing through a writer (the standard usage pattern) is vulnerable, meaning a single abrupt disconnect from an untrusted server is sufficient to bring down the client process (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack complexity is rated High, as the attacker must be in a position to act as or control the WebSocket server the client connects to (GitHub Advisory, Red Hat CVE).

1. Set up a malicious WebSocket server: Deploy a server that accepts WebSocket upgrade requests but does not perform a proper WebSocket close handshake (RFC 6455 §7).
2. Lure or position the target client: Cause a vulnerable Node.js application using undici's WebSocketStream API to connect to the attacker-controlled server (e.g., via SSRF, misconfiguration, or a man-in-the-middle position).
3. Trigger an abrupt TCP close: Once the client has established a WebSocketStream connection and holds a writer lock, abruptly close the TCP connection from the server side (e.g., send a TCP RST, drop the connection at the proxy layer, or send a protocol-violating frame).
4. Process termination: The unclean close triggers undici's socket-close handler, which calls abort() on the locked writable stream, producing an unobserved promise rejection that Node.js's default handler converts into process termination (GitHub Advisory).

• Logs: Node.js process logs showing UnhandledPromiseRejectionWarning or unhandledRejection events with a TypeError related to aborting a locked WritableStream; abrupt process exit with no application-level error handling triggered.
• Process: Unexpected termination of the Node.js process (exit code 1) coinciding with an active WebSocketStream connection; absence of a graceful shutdown sequence in application logs.
• Network: Inbound TCP RST packets or abrupt connection drops from a WebSocket server immediately preceding process termination; connections to unexpected or external WebSocket endpoints if SSRF is involved.

Users should upgrade undici to version 7.29.1 (for the 7.x branch) or 8.10.2 (for the 8.x branch), which contain the fix. The GitHub advisory explicitly states that no workaround is available. As a defense-in-depth measure until patching is possible, restrict WebSocketStream connections to trusted, controlled servers and implement process supervision (e.g., pm2, systemd restart policies) to automatically restart the process if it crashes (GitHub Advisory).

The advisory was published by Matteo Collina (mcollina), a prominent Node.js core contributor and undici maintainer, with remediation review by Ulises Gascón. Red Hat tracked the issue via Bugzilla (bug #2528712) and published a CVE advisory, indicating downstream distribution awareness. No significant broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory, Red Hat CVE).