CVE-2026-15157 Overview
CVE-2026-15157 affects undici, the HTTP/1.1 client library used by Node.js. The library does not validate the type property of a duck-typed blob-like request body before writing it into the Content-Type header on the HTTP/1.1 dispatcher. Applications that build blob-like objects from untrusted input allow attackers to inject carriage return line feed (CRLF) sequences, append arbitrary HTTP headers, and potentially smuggle a second request past the upstream server. The flaw is categorized under [CWE-93] Improper Neutralization of CRLF Sequences and belongs to the same defect class as CVE-2022-35948 and CVE-2026-1527.
Critical Impact
Attackers who control the type field of a hand-rolled blob body can inject headers and smuggle HTTP requests against the upstream server reached through undici.
Affected Products
- undici versions prior to 6.28.0
- undici versions 7.0.0 up to but not including 7.29.0
- undici versions 8.0.0 up to but not including 8.9.0
Discovery Timeline
- 2026-07-29 - CVE-2026-15157 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-15157
Vulnerability Analysis
The defect exists in undici's HTTP/1.1 dispatcher path used by request, stream, pipeline, and dispatch. When a caller supplies a body object that exposes a type property and a Blob-compatible shape (a duck-typed blob), the dispatcher copies body.type directly into the Content-Type header of the outgoing HTTP/1.1 request. The dispatcher does not strip or reject CRLF (\r\n) characters, so an attacker who influences the type value can terminate the header line early and append additional headers or an entire second request.
Native Blob objects are not exploitable because the Blob constructor strips CRLF from type at construction time. The fetch API is also unaffected because it validates headers before dispatch. The vulnerable path is reached only through ecosystem libraries or application code that constructs custom blob-like wrappers around user-controlled data.
Root Cause
The root cause is missing sanitization of the type field on duck-typed blob bodies at the header sink used by the HTTP/1.1 dispatcher. Prior fixes for CVE-2022-35948 and CVE-2026-1527 addressed related CRLF injection sinks but did not cover this specific write path.
Attack Vector
Exploitation requires an application that constructs a blob-like request body where the type property is derived from untrusted input, then passes that body to undici.request, undici.stream, undici.pipeline, or undici.dispatch. An attacker supplies a type value containing CRLF characters followed by attacker-chosen headers or a full HTTP request. The dispatcher writes the malicious value into the request stream, allowing header injection and, on vulnerable upstream configurations, HTTP request smuggling.
// No verified public exploit code is available. See the GitHub Security Advisory
// GHSA-m8rv-5g2x-5cg5 for the technical description and reproducer references.
Detection Methods for CVE-2026-15157
Indicators of Compromise
- Outbound HTTP/1.1 requests from Node.js services containing unexpected headers after the Content-Type value
- Upstream server logs showing two logical requests arriving where only one was dispatched by the application
- Content-Type header values containing raw \r\n byte sequences captured in proxy or gateway logs
Detection Strategies
- Inventory Node.js applications and dependencies using npm ls undici to identify installations of undici in the vulnerable ranges
- Perform static analysis on application code to locate call sites that pass a body object with a type field sourced from request parameters, form input, or database values
- Review dependency graphs for libraries that build duck-typed blob shapes on top of undici
Monitoring Recommendations
- Monitor egress HTTP traffic from Node.js workloads for Content-Type headers containing control characters
- Alert on upstream 400-class responses that reference malformed headers or duplicate Host headers
- Track undici version drift across CI pipelines and container images to catch regressions to vulnerable releases
How to Mitigate CVE-2026-15157
Immediate Actions Required
- Upgrade undici to 6.28.0, 7.29.0, or 8.9.0 depending on the major version in use
- Audit application code and third-party libraries for construction of blob-like objects whose type field is derived from untrusted input
- Replace custom blob-like bodies with native Blob objects, which sanitize type at construction
Patch Information
The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. See the GitHub Undici Security Advisory and the OpenJSF Security Advisories for the full technical description.
Workarounds
- Route outbound HTTP calls through fetch instead of the HTTP/1.1 dispatcher entry points, since fetch validates headers
- Sanitize any user-controlled value used as a MIME type before assigning it to a body's type property, rejecting values containing \r or \n
- Wrap untrusted content in a native Blob before dispatch so the constructor strips CRLF from type
# Upgrade undici to a fixed release
npm install undici@^8.9.0
# or, for the 7.x line
npm install undici@^7.29.0
# or, for the 6.x line
npm install undici@^6.28.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
