CVE-2026-15157

Received Received - Intake

HTTP Header Injection in Undici

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: openjs

Description

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-15157

Affected Vendors & Products

Vendor	Product	Version / Range
undici	undici	6.28.0
undici	undici	From 7.0.0 (inc) to 7.29.0 (exc)
undici	undici	From 8.0.0 (inc) to 8.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

The vulnerability in undici versions before 6.28.0, 7.29.0, and 8.9.0 involves improper validation of the type property of a blob-like request body. This allows attackers to inject CRLF sequences and append arbitrary HTTP headers, potentially enabling request smuggling past upstream servers.

Detection Guidance

To detect this vulnerability, check the installed version of undici. If your application uses undici versions before 6.28.0, 7.29.0, or 8.9.0, it may be vulnerable. Run commands like 'npm list undici' or 'yarn list undici' to inspect the version.

Impact Analysis

An attacker could exploit this to inject malicious headers or additional requests, potentially bypassing security controls, accessing unauthorized data, or performing actions on behalf of users. Systems using vulnerable undici versions with hand-rolled blob-like bodies from untrusted input are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if exploited, potentially resulting in data breaches or unauthorized transactions.

Mitigation Strategies

Upgrade undici to a patched version: 6.28.0 or later, 7.29.0 or later, or 8.9.0 or later. Review any custom blob-like request bodies in your application to ensure they do not derive the type property from untrusted input.

Hi! I’m here to help you understand CVE-2026-15157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70