The flaw exists in undici’s experimental WebSocketStream client. When a remote peer closes the TCP connection without issuing a WebSocket close handshake, the internal socket‑close handler unconditionally aborts the writable stream. Per the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds the writer and never observes the rejection, Node’s default unhandled‑rejection policy terminates the process. An attacker controlling an untrusted server can therefore crash a client with a single abrupt disconnect, without authentication or any application error.

Undici library versions 7.0.0 through 7.29.1 inclusive, and 8.0.0 through 8.10.2 inclusive, contain the vulnerable WebSocketStream implementation. Updating to undici 7.29.1 or 8.10.2 eliminates the error, as those releases correct the abort handling path.

The CVSS score of 5.9 signals moderate severity. No EPSS data is available and the vulnerability is not in the CISA KEV catalog, indicating limited public exploitation so far. The attack vector is remote: any untrusted WebSocket server can trigger an abrupt disconnect without a close handshake. No authentication or elevated privileges are required; the impact is a crash of the Node.js process, resulting in a denial of service for the affected application.