undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes
    the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close
    handler calls abort on the writable stream unconditionally and discards the returned promise, but per the
    WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError.
    Because the application holds a writer on that writable, which is the only way to write, the rejection is
    never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server
    can therefore crash a client with a single abrupt disconnect, with no authentication and no application
    mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should
    upgrade to undici 7.29.1 or 8.10.2. (CVE-2026-85014)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes     the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close     handler calls abort on the writable stream unconditionally and discards the returned promise, but per the     WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError.
    Because the application holds a writer on that writable, which is the only way to write, the rejection is     never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server     can therefore crash a client with a single abrupt disconnect, with no authentication and no application     mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should     upgrade to undici 7.29.1 or 8.10.2. (CVE-2026-85014)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448463	SCA: security update for undici (GHSA-rx4f-c7p8-82vq)	Tenable Cloud Security	SCA Checks	Local	high
448463	SCA: security update for undici (GHSA-rx4f-c7p8-82vq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
343008	Linux Distros Unpatched Vulnerability : CVE-2026-85014	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85014

high

Tenable Plugins

high

high

high