CVE-2026-15157 Details
Description
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
A CRLF injection vulnerability has been identified in the undici HTTP client library, specifically in versions prior to 6.28.0, from 7.0.0 up to 7.29.0, and from 8.0.0 up to 8.9.0. The issue arises because undici does not properly validate the type property of duck-typed blob-like request bodies before using it as the Content-Type header in the HTTP/1.1 dispatcher. This vulnerability allows attackers to inject CRLF sequences to append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are not vulnerable, but ecosystem libraries that create blob-like objects from untrusted input can exploit this flaw.
Users can upgrade to undici versions 6.28.0, 7.29.0, or 8.9.0 to address this vulnerability. Alternatively, an explicit, validated Content-Type header can be set on the request options to bypass the vulnerable code path.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5 | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | < 6.28.0 >= 7.0.0, < 7.29.0 >= 8.0.0, < 8.9.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | openjs |