Description

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T17:17:02.470Z",
  "pubdate": "2026-09-04T17:17:02.470Z",
  "executiveSummary": "The undici package contains a critical vulnerability within its experimental WebSocketStream client that leads to an unhandled promise rejection, resulting in a Node.js process termination.\nThe vulnerability is classified as a Denial-of-Service (DoS) condition triggered by an unclean TCP connection closure.\nAffected products include undici versions 7.0.0 through 7.29.0 and 8.0.0 through 8.10.1.\nAn unauthenticated, remote attacker can exploit this flaw by forcing an abrupt disconnection during a WebSocket session, causing the client application to crash.\nBecause the rejection occurs within internal logic that fails to observe the promise returned by the WritableStream abort operation, the process exits due to Node.js's default unhandled-rejection policy.\nThis vulnerability poses a significant risk to the availability of Node.js services utilizing the affected undici components, as exploitation requires no authentication and minimal network interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the WritableStream lifecycle during an unexpected TCP disconnect within the undici WebSocketStream client implementation.\nWhen a remote peer terminates the underlying TCP connection without performing a formal WebSocket close handshake, the internal socket-close handler is triggered. This handler initiates an unconditional call to the abort() method on the associated writable stream.\nAccording to the WHATWG Streams standard, if the writable stream is locked—which is the standard state when an application holds a writer to send data—the abort() method returns a promise that rejects with a TypeError.\nIn the vulnerable undici implementation, the promise returned by this abort() call is discarded and never awaited or caught. Consequently, the resulting TypeError manifests as an unhandled promise rejection.\nIn the Node.js runtime environment, unhandled promise rejections result in the termination of the process by default. Because the application-level logic does not provide a mechanism to catch this specific internal rejection, the process crashes immediately upon the server-side disconnect.\nExploitation flow: 1. An attacker initiates a WebSocket connection to a server utilizing a vulnerable undici version. 2. The client application establishes a writer for the WebSocketStream to transmit data. 3. The attacker terminates the TCP connection abruptly without sending a WebSocket-compliant close frame. 4. The undici client detects the socket closure and executes its abort routine. 5. The writable stream, being in a locked state, triggers a rejection via the abort promise. 6. The lack of an error handler for this promise causes the Node.js process to exit, successfully resulting in a Denial-of-Service.\nThis vulnerability is present in versions 7.0.0-7.29.1 and 8.0.0-8.10.2. No specific privileges or authentication are required for exploitation, as the crash is induced by the standard network communication process between a client and a peer."
}