Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-04T16:30:07 undici: undici: Denial of Service via WebSocketStream unclean close 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-390

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.

This Moderate impact flaw in the `undici` library's experimental `WebSocketStream` client can lead to a denial of service. An untrusted remote server can crash a vulnerable Node.js client application by abruptly closing a TCP connection without a WebSocket handshake. This affects the availability of applications utilizing `undici` in Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-08-12T00:00:00Z RHSA-2026:54389 nodejs26-main-26.7.0-1.5.2.hum1 Red Hat Hardened Images 2026-08-12T00:00:00Z RHSA-2026:54438 nodejs24-main-11.16.0-1.24.18.1.0.2.2.hum1 Red Hat Hardened Images 2026-09-09T00:00:00Z RHSA-2026:66008 grafana12-4-main-12.4.10-0.2.hum1 Exploit Intelligence Out of support scope exploit-intelligence/vulnerability-analysis-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat AMQ Broker 7 Fix deferred amq-broker-bin.zip Red Hat AMQ Broker 7 Fix deferred amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Fix deferred automation-platform-ui Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Fix deferred rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Enterprise Linux 10 Fix deferred nodejs22 Red Hat Enterprise Linux 10 Fix deferred nodejs24 Red Hat Enterprise Linux 10 Fix deferred nodejs26 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24 Red Hat Enterprise Linux 10 Fix deferred ubi10/nodejs-24-minimal Red Hat Enterprise Linux 8 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 8 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24 Red Hat Enterprise Linux 8 Fix deferred ubi8/nodejs-24-minimal Red Hat Enterprise Linux 9 Fix deferred nodejs:22/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:24/nodejs Red Hat Enterprise Linux 9 Fix deferred nodejs:26/nodejs Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24 Red Hat Enterprise Linux 9 Fix deferred ubi9/nodejs-24-minimal Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Will not fix nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-core-bff-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred wasmedge Red Hat Openshift Data Foundation 4 Fix deferred odf4/mcg-core-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat Trusted Artifact Signer Out of support scope rhtas/rhtas-console-ui-rhel9 Secrets Management Console for Red Hat OpenShift Out of support scope external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-85014 https://nvd.nist.gov/vuln/detail/CVE-2026-85014 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq