Listen to this Post
How CVE-2026-15157 Works
Undici is a high-performance HTTP/1.1 client for Node.js. Prior to versions 6.28.0, 7.29.0, and 8.9.0, it fails to validate the `type` property of duck‑typed blob‑like request bodies before using it as the `Content‑Type` header on the HTTP/1.1 dispatcher. The vulnerable code path – located in `lib/dispatcher/client-h1.js` – pushes `body.type` directly into the outgoing headers without passing it through isValidHeaderValue(), the validation function that protects every other header sink in Undici.
An attacker who controls the `type` property of a hand‑rolled blob‑like object can inject CRLF sequences (\r\n) into the `Content‑Type` header. Because the header is not sanitized, the injected CRLF terminates the current header line and allows the attacker to append arbitrary HTTP headers – or even a complete second HTTP request – to the same outgoing connection. This can lead to HTTP request smuggling, where a malicious request is prepended to a legitimate one, bypassing upstream security controls, cache poisoning, or session hijacking.
The vulnerable branch is triggered when an application passes a duck‑typed blob‑like body via request(), stream(), pipeline(), or dispatch(). Native `Blob` objects are safe because their constructor strips CRLF from the `type` property, and the `fetch()` API is unaffected because it validates headers through the `Headers` class. However, ecosystem libraries such as form-data-encoder, formdata-polyfill, and `formdata-node` build duck‑typed blob shapes from user input, making them the primary entry points for exploitation.
This vulnerability is the same defect class as CVE‑2022‑35948 and CVE‑2026‑1527 – both of which were fixed by adding `isValidHeaderValue()` on their respective header sinks. The `Content‑Type` sink was overlooked in those earlier patches, leaving this new vector open. The issue is now fully addressed in the patched releases.
DailyCVE Form:
Platform: Node.js / undici
Version: <6.28.0, 7.0.0‑7.28.0, 8.0.0‑8.8.0
Vulnerability: CRLF Injection (CWE‑93)
Severity: Medium (CVSS 4.2)
date: 2026‑07‑29
Prediction: Already patched (6.28.0/7.29.0/8.9.0)
What Undercode Say
Analytics – The vulnerable code path is triggered only when a duck‑typed blob‑like object is passed and its `type` property is derived from untrusted user input. Native `Blob` and `fetch()` are not affected. The attack requires moderate complexity (CVSS:AC:H) and user interaction (CVSS:UI:R), limiting mass exploitation. However, the impact includes header injection and request smuggling, which can compromise upstream caches and proxies. The EPSS score is 0.14%, indicating low likelihood of active exploitation in the wild as of August 2026.
Bash Commands & Codes – To check your undici version:
npm list undici
To upgrade to a patched version:
npm install [email protected] for 6.x npm install [email protected] for 7.x npm install [email protected] for 8.x
Exploit – A minimal proof‑of‑concept (for educational purposes) would pass a duck‑typed object with a malicious type:
const { request } = require('undici');
const maliciousBody = {
type: 'application/x-www-form-urlencoded\r\nX-Injected: evil',
// ... other blob‑like properties (size, etc.)
};
// This will send "Content-Type: application/x-www-form-urlencoded\r\nX-Injected: evil"
await request('https://target.example.com/upload', {
method: 'POST',
body: maliciousBody
});
The injected CRLF sequence appends an arbitrary header, and with additional CRLFs a second request can be smuggled.
Protection – Upgrade to undici 6.28.0, 7.29.0, or 8.9.0 immediately. If upgrading is not possible, sanitize the `type` property of any duck‑typed blob‑like object before passing it to Undici, or use native `Blob` objects exclusively. Avoid constructing blob‑like shapes from untrusted user input, and audit third‑party libraries that perform such construction.
Impact – Successful exploitation allows an unauthenticated attacker to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream server. This can lead to cache poisoning, request routing manipulation, session fixation, or bypass of security filters, depending on the upstream infrastructure. The vulnerability does not directly expose data or enable remote code execution, but it can be chained with other weaknesses to achieve more severe outcomes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
