Skip to main content

undici CVE-2026-15157

| EUVDEUVD-2026-50568 MEDIUM
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-07-29 openjs GHSA-m8rv-5g2x-5cg5
Code Injection Undici Red Hat
5.4
CVSS 3.1 · NVD
Share

Severity by source

Vendor (openjs) PRIMARY
MEDIUM
qualitative
NVD
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vuln.today AI
4.7 MEDIUM

S:C reflects request smuggling crossing trust boundaries to upstream systems; AC:H and UI:R capture the narrow, application-code-dependent exploitation path requiring untrusted type input.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.2 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
CVSS changed
Aug 04, 2026 - 15:53 NVD
4.2 (MEDIUM) 5.4 (MEDIUM)
Patch available
Jul 29, 2026 - 22:02 EUVD
Analysis Generated
Jul 29, 2026 - 21:51 vuln.today
CVE Published
Jul 29, 2026 - 21:17 cve.org
MEDIUM 4.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

AnalysisAI

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify application using undici duck-typed blob with user input
Delivery
Craft type value embedding CRLF sequences
Exploit
Submit request with malicious type field
Execution
undici writes type verbatim to Content-Type header
Persist
CRLF terminates header block, injects arbitrary headers
Impact
Smuggled second request reaches upstream server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all three of the following conditions simultaneously: first, the application (or a library it depends on) must call undici's request, stream, pipeline, or dispatch API directly rather than the native fetch API; second, the body passed to that call must be a duck-typed plain-object blob shape rather than a native Blob instance; third, the type property of that blob-like object must be derived from attacker-controlled input without prior CRLF sanitisation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS score of 4.2 (Medium) reflects genuine exploitation constraints: AC:H encodes the narrow code-path requirement (duck-typed blob with an untrusted type property), and UI:R captures the dependency on application code forwarding attacker-controlled data into that path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a file-upload field or content-type parameter to a Node.js application that uses a wrapper library over undici's dispatch API, where the library constructs a duck-typed blob-like object setting type from the incoming request value. By embedding a CRLF sequence in that value - for example, image/png\r\nX-Injected-Header: evil - the attacker causes undici to emit a split Content-Type header followed by an attacker-controlled header, which can be followed by a complete second HTTP request body. …
Remediation Upgrade undici to the patched release for the in-use branch: 6.28.0 for 6.x consumers, 7.29.0 for 7.x consumers, or 8.9.0 for 8.x consumers, as confirmed by the vendor advisory at https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-6734 HIGH
8.8 Jun 17

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
CVE-2026-9675 HIGH
7.5 Jun 17

Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior t
CVE-2026-2229 HIGH
7.5 Mar 12

Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-70615 HIGH POC
8.5
CVE-2024-45302 HIGH POC
7.8
CVE-2017-5868 MEDIUM POC
6.1
CVE-2026-21428 HIGH POC
7.5
CVE-2022-0666 HIGH POC
7.5

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-15157 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy