The vulnerability lies in undici’s experimental WebSocketStream client. When a remote peer closes the TCP connection without sending a WebSocket close handshake, the socket‑close handler unconditionally aborts the writable stream. According to the WHATWG Streams standard, aborting a locked writable stream returns a promise that rejects with a TypeError. Because the application holds the writer, the rejection is never observed. Node’s default unhandled‑rejection policy terminates the process, resulting in a denial of service. This flaw maps to CWE‑248 (Unchecked Return Value) and CWE‑754 (Dependency on Functions That Can Raise Exceptions).

Version ranges of the undici library are affected. All releases from 7.0.0 through 7.29.1 inclusive, and from 8.0.0 through 8.10.2 inclusive, contain the vulnerable WebSocketStream implementation. Users should update to undici 7.29.1 or 8.10.2, which include a corrected abort handling path.

The CVSS score of 5.9 indicates a moderate severity vulnerability. EPSS information is not available and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet. The attack vector is remote: any untrusted server communicating over a WebSocket can trigger an abrupt disconnect without a close handshake, leading to an unobserved promise rejection and a process crash. No authentication or privileged access is required. The impact is local to the affected process and results in a denial of service for the running application.