Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-29T21:17:44 undici: undici: HTTP header injection via unvalidated blob-like body type property 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CWE-93

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a `type` property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed (CRLF) sequences. This vulnerability enables the attacker to append arbitrary HTTP headers, potentially leading to the smuggling of a second request past the upstream server. This could result in limited information disclosure and integrity impact.

Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48273 nodejs26-main-26.5.1-1.5.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48537 nodejs24-main-24.18.1-0.1.hum1 Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Will not fix nodejs25 Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected rust https://www.cve.org/CVERecord?id=CVE-2026-15157 https://nvd.nist.gov/vuln/detail/CVE-2026-15157 https://cna.openjsf.org/security-advisories.html https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5