Listen to this Post
How CVE-2026-15157 Works
The vulnerability resides in undici’s HTTP/1.1 dispatcher, specifically within the `lib/dispatcher/client-h1.js` file. When an application passes a duck-typed blob-like object as the request body via methods like request(), stream(), pipeline(), or dispatch(), the library checks if the body is blob-like and if a `content-type` header hasn’t already been set. If both conditions are met, it directly pushes the `body.type` property into the outgoing headers array.
The critical flaw is that this path completely bypasses the `isValidHeaderValue()` function, which is used for validating every other header in undici. This validation function is designed to reject control characters like CR (\r) and LF (\n). Because the `body.type` is used unsanitized, an attacker who can control this value can inject CRLF sequences.
The exploitation requires a hand-rolled duck-typed object or a `Blob` subclass with a controllable `.type` property. Native `Blob` objects are safe because their constructor inherently strips CRLF characters from the type. Similarly, the `fetch()` API is unaffected as it uses the `Headers` class for validation.
This vulnerability is part of the same defect class as two previous CVEs: CVE-2022-35948 (a `content-type` sink fixed in undici 5.8.2) and CVE-2026-1527 (an `upgrade` option sink fixed in 6.24.0 / 7.24.0). Both were patched by adding `isValidHeaderValue()` checks on their respective sinks, but this specific branch was missed.
Ecosystem libraries that construct these duck-typed blob shapes from user input, such as form-data-encoder, formdata-polyfill, and formdata-node, are potential vectors for this attack. An attacker exploiting this can inject arbitrary HTTP headers and potentially smuggle a second request past the upstream server.
DailyCVE Form:
Platform: Node.js
Version: <6.28.0, 7.0.0-7.28.0, 8.0.0-8.8.0
Vulnerability: CRLF Injection
Severity: Moderate
date: 2026-07-29
Prediction: 2026-07-29
What Undercode Say:
Analytics:
- Affected Package: `undici`
– CVSS Score: 4.2 (Medium) - CWE: 113 – Improper Neutralization of CRLF Sequences in HTTP Headers
- Attack Vector: Network
- Complexity: High
- Privileges Required: None
Exploit:
An attacker can exploit this by crafting a duck-typed blob-like object with a malicious `type` property containing CRLF sequences. The following is a conceptual example:
// Example of a duck-typed blob object
const maliciousBody = {
type: 'text/plain\r\nX-Malicious-Header: injected\r\n\r\n',
// ... other blob-like properties (size, slice, etc.)
};
// When passed to undici's dispatcher
// await undici.request(url, { method: 'POST', body: maliciousBody });
// This would cause the 'type' to be injected as headers.
Protection:
- Upgrade: Immediately upgrade to undici version v6.28.0, v7.29.0, or v8.9.0 or later.
- Set Explicit Content-Type: Set an explicit, validated `content-type` header in the request options to bypass the vulnerable branch.
- Use Native Blob: Use a native `Blob` (or
fetch-blob) instead of a hand-rolled duck-typed object. - Sanitize Input: Reject control characters in the MIME type before assigning it to the `.type` property.
- Use Fetch API: Prefer using the `fetch()` API over the non-fetch APIs.
Impact:
Successful exploitation allows an attacker to:
- Inject arbitrary HTTP headers into an outgoing request.
- Potentially smuggle a second request past the upstream server, leading to HTTP request smuggling.
- This can lead to a wide range of attacks, including cache poisoning, session hijacking, and bypassing security controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
