Request Handling Vulnerability in Undici by Node.js

CVE-2026-15157

What is CVE-2026-15157?

The undici library, utilized in Node.js applications, has a vulnerability that occurs when the type property of a duck-typed blob-like request body is not validated. This oversight can allow an attacker to inject CRLF sequences, enabling the possibility of appending arbitrary HTTP headers and potentially smuggling a second request past the upstream server. While native Blob objects are safe due to their constructor's CRLF filtering, libraries that construct duck-typed blob shapes from untrusted input are at risk. This issue is not a standalone flaw, as it correlates to similar vulnerabilities previously identified. The vulnerability is addressed in undici versions 6.28.0, 7.29.0, and 8.9.0.

References