CVE-2026-15157: CVE-2026-15157: CRLF Injection in undici HTTP/1.1 Dispatcher

CVE-2026-15157: CRLF Injection in undici HTTP/1.1 Dispatcher

Vulnerability ID: CVE-2026-15157
CVSS Score: 4.2
Published: 2026-08-03

CVE-2026-15157 details an improper neutralization of CRLF sequences ('CRLF Injection') within undici, a widely used Node.js HTTP/1.1 client. The vulnerability is triggered when processing request bodies that exhibit a duck-typed blob-like interface. When an application accepts untrusted data and assigns it to the .type property of such an object without setting an explicit Content-Type on the request, undici appends the value directly to the outgoing headers array without validating it against control characters. This allows remote attackers to inject carriage return and line feed sequences, culminating in arbitrary header injection, HTTP response splitting, or HTTP request smuggling.

TL;DR

A vulnerability in undici allows attackers to inject CRLF sequences via duck-typed blob bodies, leading to HTTP Request Smuggling and Header Injection.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-93
• Attack Vector: Network
• CVSS v3.1: 4.2 (Medium)
• EPSS Score: 0.00142
• Impact: Low Confidentiality, Low Integrity
• Exploit Status: PoC Available
• KEV Status: Not Listed

Affected Systems

• undici HTTP client
• Node.js applications leveraging undici dispatcher
• Ecosystem libraries constructing custom duck-typed Blobs
• undici: < 6.28.0 (Fixed in: 6.28.0)
• undici: >= 7.0.0 < 7.29.0 (Fixed in: 7.29.0)
• undici: >= 8.0.0 < 8.9.0 (Fixed in: 8.9.0)

Code Analysis

Commit: 33928bc

fix: validate blob body content type (v6 branch)

@@ -1200,8 +1201,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }

Commit: 740a0b7

fix: validate blob body content type (v7 branch)

@@ -1200,8 +1201,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }

Commit: 7d3cf92

fix: validate blob body content type (v8 branch)

@@ -1200,8 +1201,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }

Mitigation Strategies

• Upgrade undici to non-vulnerable versions
• Enforce explicit Content-Type validation on outgoing requests
• Sanitize and strip CRLF characters from metadata assigned to duck-typed blobs

Remediation Steps:

1. Analyze the application dependency tree to locate vulnerable undici instances.
2. Execute 'npm install undici@latest' or pin dependency versions to >=6.28.0, >=7.29.0, or >=8.9.0.
3. Scan codebases for custom Blob objects containing dynamic properties assigned from user input.

References

• GitHub Security Advisory
• OpenJS Foundation Security Advisories
• NVD CVE-2026-15157 Record
• CVE.org Record

---

Read the full report for CVE-2026-15157 on our website for more details including interactive diagrams and full exploit analysis.