undici vulnerable to Denial of Service via WebSocketStream unclean close

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-85014 · Microsoft / collected KEV context

EUVD-2026-71465

GHSA-rx4f-c7p8-82vq

cve-program · CVE-2026-85014

• https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71465

• https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-85014

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq

osv · GHSA-rx4f-c7p8-82vq

• https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq
• https://nvd.nist.gov/vuln/detail/CVE-2026-85014
• https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349
• https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writab… · Advisory content revised · 5 Nov 2026