CVE-2026-15157: undici CRLF injection in blob-like request body type property

Executive brief

Undici, a popular HTTP client for Node.js, is vulnerable to a security flaw when handling specific types of data objects. If an application uses untrusted input to define the 'type' of a data blob, an attacker could inject malicious characters to manipulate HTTP headers. This could allow an attacker to bypass security controls or perform request smuggling, potentially compromising the integrity of communications between services.

Technical details

A CRLF injection vulnerability exists in undici's HTTP/1.1 dispatcher within `lib/dispatcher/client-h1.js`. When an application passes a duck-typed blob-like body to functions such as `request()` or `stream()`, the `.type` property is pushed directly into the outgoing 'content-type' header without validation via `isValidHeaderValue()`. An attacker providing a hand-rolled blob object with a malicious `.type` string containing `\r\n` sequences can inject arbitrary HTTP headers or perform request smuggling. Native `Blob` objects are not affected as their constructors strip CRLF sequences. The issue is patched in versions 6.28.0, 7.29.0, and 8.9.0.

Affected products

• Node.js undici < 6.28.0, >= 7.0.0 < 7.29.0, >= 8.0.0 < 8.9.0

Timeline

• 2026-07-29: disclosed
• 2026-07-29: patched
• 2026-08-03: advisory

References

• https://api.github.com/users/mcollina
• https://github.com/mcollina
• https://api.github.com/users/mcollina/gists%7B/gist_id%7D
• https://api.github.com/users/mcollina/repos
• https://avatars.githubusercontent.com/u/52195?v=4
• https://api.github.com/users/mcollina/events%7B/privacy%7D