Skip to main content

undici CVE-2026-15157

| EUVDEUVD-2026-50568 MEDIUM
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-07-29 openjs GHSA-m8rv-5g2x-5cg5
Code Injection Red Hat Undici
5.4
CVSS 3.1 · NVD
Share

Severity by source

Vendor (openjs) PRIMARY
MEDIUM
qualitative
NVD
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vuln.today AI
4.7 MEDIUM

S:C reflects request smuggling crossing trust boundaries to upstream systems; AC:H and UI:R capture the narrow, application-code-dependent exploitation path requiring untrusted type input.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.2 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
CVSS changed
Aug 04, 2026 - 15:53 NVD
4.2 (MEDIUM) 5.4 (MEDIUM)
Patch available
Jul 29, 2026 - 22:02 EUVD
Analysis Generated
Jul 29, 2026 - 21:51 vuln.today
CVE Published
Jul 29, 2026 - 21:17 cve.org
MEDIUM 4.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

AnalysisAI

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applications pass duck-typed blob-like bodies whose type property is populated from untrusted input. Affected are the 6.x branch before 6.28.0, all 7.x releases from 7.0.0 through 7.28.x, and all 8.x releases from 8.0.0 through 8.8.x, when callers use the request, stream, pipeline, or dispatch APIs with hand-rolled blob-shaped objects rather than native Blob instances or the fetch API. An attacker who controls the type value can append arbitrary HTTP headers to the outgoing request, potentially smuggling a second request past an upstream proxy or server. No public exploit identified at time of analysis and KEV status is not confirmed in the provided data.

Technical ContextAI

undici (cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*) is the HTTP/1.1 client library that underpins Node.js's native fetch implementation and is widely consumed across the Node.js ecosystem both directly and through wrapper libraries. The root cause (CWE-93: Improper Neutralization of CRLF Sequences) is that the HTTP/1.1 dispatcher reads the type property of any blob-like body object and writes it verbatim into the outgoing Content-Type header without stripping carriage-return or line-feed characters. Native Blob objects are not affected because the Blob constructor already sanitises CRLF from type strings at construction time, and the fetch API is separately protected by its own header validation layer. The vulnerable sink is reached only when application code or an ecosystem library constructs a plain-object duck-typed blob from external data and passes it directly to one of undici's lower-level dispatch APIs. The defect class is identical to CVE-2022-35948 and CVE-2026-1527; this instance covers a header sink that the earlier remediations did not address.

RemediationAI

Upgrade undici to the patched release for the in-use branch: 6.28.0 for 6.x consumers, 7.29.0 for 7.x consumers, or 8.9.0 for 8.x consumers, as confirmed by the vendor advisory at https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5. If an immediate upgrade is blocked, the safest short-term workaround is to replace duck-typed blob-shaped objects with native Blob instances (new Blob([data], { type: contentType })), whose constructor strips CRLF automatically, before passing them to undici; this eliminates the vulnerable path without requiring CRLF sanitisation logic at every call site. Alternatively, apply explicit CRLF stripping (remove \r and \n) to any externally derived string before assigning it to a blob-like object's type field - but this must be enforced at every call site and is error-prone. Third-party libraries that wrap undici and construct duck-typed blobs from request input should be audited for this pattern and updated independently.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-84961 CRITICAL
9.1 Sep 04

TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
CVE-2026-6734 HIGH
8.8 Jun 17

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
CVE-2026-84933 HIGH
8.2 Sep 04

undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so i

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2026-84372 CRITICAL POC
9.8
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-54511 HIGH POC
8.6
CVE-2026-70615 HIGH POC
8.5
CVE-2025-59151 HIGH POC
8.2
CVE-2024-45302 HIGH POC
7.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-15157 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy