undici vulnerable to Denial of Service via WebSocketStream unclean close

CVE-2026-85014 is an uncaught-exception (CWE-248) denial-of-service in undici's WebSocketStream implementation. When a Node.js application initiates a WebSocketStream connection and the remote server drops the TCP socket without completing the WebSocket close handshake (an "unclean close"), the #onSocketClose callback attempts to read this.#parser.closingInfo before the parser has been initialized. The resulting TypeError propagates unhandled, crashing the Node.js process. The bug affects applications that use the newer WebSocketStream API — not the older new WebSocket(…) constructor — and specifically requires the *client* to connect to a server under attacker influence. Affected versions span undici 7.x prior to the WebSocketStream close-handling fix (aligned with Node.js v24 line); the 6.x branch is unaffected because WebSocketStream was not backported to it.

The vendor's MEDIUM / 5.9 rating is *fair but slightly generous*. The CVSS vector already encodes AC:H, reflecting the need for specific conditions, but it doesn't capture two real-world narrowing factors: (1) WebSocketStream adoption is a small fraction of all undici WebSocket usage — most applications use the standard WebSocket class, and (2) the crash is a single-process DoS that is auto-recoverable under any modern process manager (PM2, systemd, Kubernetes liveness probe). noisgate trims the effective score to 4.5 while keeping the MEDIUM bucket.

Why this verdict

• Narrow API surface: WebSocketStream is a newer, less-adopted API. The overwhelming majority of Node.js WebSocket usage goes through ws, socket.io, or undici's standard WebSocket class — none of which are affected.
• Attacker-influenced server required: The victim app must *initiate* the WebSocket connection to an endpoint the attacker controls or can redirect to (via DNS hijack / SSRF). Server-side WebSocket listeners — the dominant pattern — are not vulnerable.
• Race condition (AC:H): The TCP close must land in the narrow initialization window before the parser is assigned. This is non-deterministic and many attempts will fail silently.
• Auto-recoverable crash: Process managers (PM2, systemd, Kubernetes) restart the process in seconds. The blast radius is a brief availability blip, not persistent compromise.
• Role multiplier: undici ships with Node.js (~150M weekly downloads), so the *theoretical* install base is enormous. However, WebSocketStream-based outbound connections are vanishingly rare in high-value roles. In CI/CD pipelines, API servers, and backend services, the standard WebSocket or HTTP client paths dominate. No high-value-role scenario (IdP, hypervisor, PAM, backup, EDR) canonically relies on undici WebSocketStream outbound connections. The blast radius in any deployment is single-process DoS — it does not escalate to host, domain, or fleet compromise. The floor rule does not elevate this beyond MEDIUM.

Why not higher?

Elevating to HIGH would require either active exploitation evidence, a broader affected API surface, or an impact beyond single-process availability disruption. None of these conditions are met. The AC:H race window, the requirement for an attacker-controlled server destination, and the auto-recoverability of the crash all argue against a higher rating.

Why not lower?

Dropping to LOW would undercount the fact that this *is* a remotely triggerable, unauthenticated process crash with no user interaction required. If a vulnerable application does connect to untrusted WebSocket endpoints (e.g., a proxy, aggregator, or federation service), the crash is reliable enough after repeated attempts. The 4.5 score preserves the signal that this bug deserves a patch, just not an emergency one.

1. Add a global uncaughtException handler to Node.js services — A process.on('uncaughtException', handler) catches the fatal TypeError and keeps the process alive. This neutralizes the crash path entirely while you schedule the undici upgrade within the noisgate remediation SLA of 365 days.
2. Allowlist outbound WebSocket destinations — If your application uses WebSocketStream, restrict the target URLs to a known-good allowlist via environment config or a network-layer egress policy. This eliminates the attacker-controlled-server prerequisite.
3. Ensure process-manager auto-restart is configured — Verify that PM2, systemd Restart=always, or Kubernetes liveness probes are active for all Node.js services. This limits blast radius to a momentary restart even if the crash fires. No additional SLA — this should already be in place.
4. Upgrade undici to ≥ 7.24.0 or pin Node.js to a patched release — The definitive fix. Schedule within the 365-day noisgate remediation SLA for MEDIUM findings. If you track Node.js LTS releases, confirm the bundled undici version includes the WebSocketStream close-handling patch.

Run on any host with Node.js installed to check whether the bundled or installed undici version is vulnerable. No special privileges required. Example: bash check_undici.sh

#!/usr/bin/env bash
# check_undici.sh — Detect CVE-2026-85014 (undici WebSocketStream unclean close DoS)
# Run on any host with node installed. No privileges required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Try to get undici version from node's built-in
UNDICI_VER=$(node -e "try { const v = process.versions.undici || require('undici/package.json').version; console.log(v); } catch(e) { console.log('NONE'); }" 2>/dev/null || echo "NONE")

if [ "$UNDICI_VER" = "NONE" ]; then
  echo "UNKNOWN — undici not found (not bundled or not installed)"
  exit 2
fi

echo "Detected undici version: $UNDICI_VER"

# Parse major and minor
MAJOR=$(echo "$UNDICI_VER" | cut -d. -f1)
MINOR=$(echo "$UNDICI_VER" | cut -d. -f2)

# 6.x is not affected (no WebSocketStream)
if [ "$MAJOR" -le 6 ]; then
  echo "PATCHED — undici $UNDICI_VER (6.x branch does not include WebSocketStream)"
  exit 0
fi

# 7.x: fixed in 7.24.0+
if [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -ge 24 ]; then
    echo "PATCHED — undici $UNDICI_VER (>= 7.24.0)"
    exit 0
  else
    echo "VULNERABLE — undici $UNDICI_VER (7.x < 7.24.0)"
    exit 1
  fi
fi

# 8.x+: assume patched (fix forward-ported)
if [ "$MAJOR" -ge 8 ]; then
  echo "PATCHED — undici $UNDICI_VER (8.x includes close-handling fix)"
  exit 0
fi

echo "UNKNOWN — unexpected version $UNDICI_VER"
exit 2

Sources

1. undici GitHub issue #4732 — WebSocketStream internal error on connection failure
2. GHSA-v9p9-hfj2-hcw8 — Unhandled Exception in WebSocket Client (CVE-2026-2229)
3. Snyk — Uncaught Exception in undici (CVE-2026-1528)
4. GHSA-vxpw-j846-p89q — WebSocket fragment count bypass DoS (CVE-2026-12151)
5. undici releases — GitHub
6. NVD — CVE-2026-12151 Detail
7. undici npm package