{"id":"CVE-2026-15157","aliases":["AZL-94440","CLSA-2026-1790542220","CLSA-2026-1791028079","CLSA-2026-1791028234","CLSA-2026-1791973587","CLSA-2026-1792451423","CLSA-2026-1792867313","DEBIAN-CVE-2026-15157","EUVD-2026-50568","GHSA-m8rv-5g2x-5cg5","RHSA-2026:48273","RHSA-2026:48537","ROOT-APP-NPM-CVE-2026-15157","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1","SUSE-SU-2026:4355-1","UBUNTU-CVE-2026-15157"],"status":"published","title":"undici vulnerable to CRLF Injection via blob-like body 'type' property","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00261,"percentile":0.18096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-07-29T21:17:44Z","modified":"2026-10-31T15:02:25Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["6.28.0","7.29.0","8.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.9.0+dfsg+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["6.26.0-aikido.3","6.26.0-aikido.4","6.26.0-aikido.5","7.29.0-aikido.1","7.29.0-aikido.2","6.28.0-aikido.1","7.29.0-aikido.3","6.28.0-aikido.2","7.29.0-aikido.4","7.29.0-aikido.5","6.28.0-aikido.3","7.29.0-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["6.26.0-root.io.3","6.26.0-root.io.4","6.26.0-root.io.5","7.29.0-root.io.1","7.29.0-root.io.2","6.28.0-root.io.1","7.29.0-root.io.3","6.28.0-root.io.2","7.29.0-root.io.4","7.29.0-root.io.5","6.28.0-root.io.3","7.29.0-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.28.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.20.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.7-tuxcare.0"},{"fixed":"6.19.7-tuxcare.1"}]}],"versions":["6.19.7"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.19.5-tuxcare.0"},{"fixed":"6.19.5-tuxcare.2"}]}],"versions":["6.19.5","6.19.5-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.7"}]}],"versions":["7.28.0","7.28.0-tuxcare.1","7.28.0-tuxcare.2","7.28.0-tuxcare.3","7.28.0-tuxcare.4","7.28.0-tuxcare.5","7.28.0-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.1"}]}],"versions":["7.24.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici-types","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.20.0-tuxcare.0"},{"fixed":"6.20.0-tuxcare.3"}]}],"versions":["6.20.0","6.20.0-tuxcare.1","6.20.0-tuxcare.2"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0+dfsg+~cs3.2.0-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.28.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.5.1.1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.1.0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.26.0-aikido.3"},{"fixed":"6.26.0-aikido.4"},{"fixed":"6.26.0-aikido.5"},{"fixed":"7.29.0-aikido.1"},{"fixed":"7.29.0-aikido.2"},{"fixed":"6.28.0-aikido.1"},{"fixed":"7.29.0-aikido.3"},{"fixed":"6.28.0-aikido.2"},{"fixed":"7.29.0-aikido.4"},{"fixed":"7.29.0-aikido.5"},{"fixed":"6.28.0-aikido.3"},{"fixed":"7.29.0-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.26.0-root.io.3"},{"fixed":"6.26.0-root.io.4"},{"fixed":"6.26.0-root.io.5"},{"fixed":"7.29.0-root.io.1"},{"fixed":"7.29.0-root.io.2"},{"fixed":"6.28.0-root.io.1"},{"fixed":"7.29.0-root.io.3"},{"fixed":"6.28.0-root.io.2"},{"fixed":"7.29.0-root.io.4"},{"fixed":"7.29.0-root.io.5"},{"fixed":"6.28.0-root.io.3"},{"fixed":"7.29.0-root.io.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.44.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-150400.9.39.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.42.1"}]}],"bundled":31},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5","tags":["Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157","tags":["web","advisory"]},{"url":"https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v6.28.0","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.0","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.9.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m8rv-5g2x-5cg5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15157.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15157","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48273","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58043","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56850","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58040","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15157","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48273.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15157","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58041","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56846","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://bugzilla.suse.com/1254738","tags":["report"]},{"url":"https://bugzilla.suse.com/1256570","tags":["report"]},{"url":"https://bugzilla.suse.com/1256573","tags":["report"]},{"url":"https://bugzilla.suse.com/1256574","tags":["report"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1272958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264261-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236250","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-15157","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-15157","title":"undici vulnerable to CRLF Injection via blob-like body 'type' property","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T21:17:44.74Z","modified":"2026-07-30T15:18:02.97Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-50568","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T21:17:44Z","modified":"2026-07-30T15:18:02Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:28.463488Z"}],"ghsa":[{"id":"GHSA-m8rv-5g2x-5cg5","title":"undici vulnerable to CRLF Injection via blob-like body 'type' property","description":"### Impact\n\nWhen an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\\r\\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.\n\nThe vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`:\n\n```javascript\n} else if (util.isBlobLike(body) \u0026\u0026 request.contentType == null \u0026\u0026 body.type) {\n  headers.push('content-type', body.type)  // bypasses isValidHeaderValue()\n}\n```\n\nThe bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled `.type`. Native `Blob` is safe because its constructor strips CRLF from `.type`. `fetch()` is unaffected because it validates via the `Headers` class. Ecosystem consumers that build duck-typed blob shapes from user input include `form-data-encoder`, `formdata-polyfill`, and `formdata-node`.\n\nSame defect class as `CVE-2022-35948` (explicit `content-type` sink, fixed in undici 5.8.2) and `CVE-2026-1527` (`upgrade` option sink, fixed in 6.24.0 / 7.24.0), both closed by adding `isValidHeaderValue()` on their respective sinks. This branch was missed.\n\n### Patches\n\nPatched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.\n\n### Workarounds\n\n- Set an explicit, validated `content-type` header on the request options (skips the vulnerable branch).\n- Use a native `Blob` (or `fetch-blob`) instead of a hand-rolled duck-typed object.\n- Reject control characters in the MIME type before assigning it to `.type`.\n- Use `fetch()` instead of the non-`fetch` APIs.","status":"published","published":"2026-08-03T19:33:53Z","modified":"2026-08-03T19:33:56Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-15157","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T22:16:52.463Z","modified":"2026-08-04T15:41:50.45Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-15157","title":"undici vulnerable to CRLF Injection via blob-like body 'type' property","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T21:17:44.74Z","modified":"2026-10-28T02:30:46.661697592Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-15157","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T22:16:52.463Z","modified":"2026-10-01T03:02:25.40024522Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"GHSA-m8rv-5g2x-5cg5","title":"undici vulnerable to CRLF Injection via blob-like body 'type' property","description":"### Impact\n\nWhen an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `stream()`, `pipeline()`, or `dispatch()`) with a `.type` derived from untrusted input, an attacker can inject CRLF sequences (`\\r\\n`) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.\n\nThe vulnerable branch in `lib/dispatcher/client-h1.js` pushes `body.type` directly into the outgoing headers with no validation, while every other header path in undici goes through `isValidHeaderValue()`:\n\n```javascript\n} else if (util.isBlobLike(body) \u0026\u0026 request.contentType == null \u0026\u0026 body.type) {\n  headers.push('content-type', body.type)  // bypasses isValidHeaderValue()\n}\n```\n\nThe bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled `.type`. Native `Blob` is safe because its constructor strips CRLF from `.type`. `fetch()` is unaffected because it validates via the `Headers` class. Ecosystem consumers that build duck-typed blob shapes from user input include `form-data-encoder`, `formdata-polyfill`, and `formdata-node`.\n\nSame defect class as `CVE-2022-35948` (explicit `content-type` sink, fixed in undici 5.8.2) and `CVE-2026-1527` (`upgrade` option sink, fixed in 6.24.0 / 7.24.0), both closed by adding `isValidHeaderValue()` on their respective sinks. This branch was missed.\n\n### Patches\n\nPatched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.\n\n### Workarounds\n\n- Set an explicit, validated `content-type` header on the request options (skips the vulnerable branch).\n- Use a native `Blob` (or `fetch-blob`) instead of a hand-rolled duck-typed object.\n- Reject control characters in the MIME type before assigning it to `.type`.\n- Use `fetch()` instead of the non-`fetch` APIs.","status":"published","published":"2026-08-03T19:33:53Z","modified":"2026-09-10T03:51:14.281925419Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"RHSA-2026:48273","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:10Z","modified":"2026-10-20T10:10:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48537","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:12Z","modified":"2026-10-20T10:10:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-15157","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T22:16:00Z","modified":"2026-10-17T12:59:53.170486514Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-94440","title":"CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1","description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","status":"published","published":"2026-07-29T22:16:52Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"CLSA-2026-1790542220","title":"TuxCare security update for undici (12 CVEs)","description":"TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1.","status":"published","published":"2026-09-27T20:50:20Z","modified":"2026-10-15T09:45:09.792474642Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791028079","title":"TuxCare security update for undici (11 CVEs)","description":"TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2.","status":"published","published":"2026-10-03T11:47:59Z","modified":"2026-10-15T09:47:57.895518604Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791028234","title":"TuxCare security update for undici (3 CVEs)","description":"TuxCare rebuilt undici to address 3 CVEs. Fixed in 7.28.0-tuxcare.7.","status":"published","published":"2026-10-03T11:50:34Z","modified":"2026-10-15T09:47:38.630877288Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791973587","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-14T10:26:27Z","modified":"2026-10-24T19:15:03.446818583Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792451423","title":"TuxCare security update for undici (5 CVEs)","description":"TuxCare rebuilt undici to address 5 CVEs. Fixed in 7.24.4-tuxcare.1.","status":"published","published":"2026-10-19T23:10:23Z","modified":"2026-10-20T01:45:10.047350061Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792867313","title":"TuxCare security update for undici-types (15 CVEs)","description":"TuxCare rebuilt undici-types to address 15 CVEs. Fixed in 6.20.0-tuxcare.3.","status":"published","published":"2026-10-24T18:41:49Z","modified":"2026-10-25T01:30:04.32437095Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2026-15157","title":"CVE-2026-15157 in undici - Patched by Root","description":"Root has patched CVE-2026-15157 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T10:48:45Z","modified":"2026-10-30T11:15:02.404115483Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2026:4248-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-17T15:59:50Z","modified":"2026-09-18T10:00:04.762818452Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4261-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request\n  (bsc#1236258).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n\nChanges for nodejs18:\n \n- upgraded embedded undici to 6.28.0.\n- upgraded embedded nghttp2 to 1.69.0.\n","status":"published","published":"2026-09-18T07:44:28Z","modified":"2026-09-18T18:00:04.233169266Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4355-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous\n  operations and lead to exposure of in-process secrets (bsc#1256570).\n- CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error\n  (bsc#1256573).\n- CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is enabled can\n  lead to crash (bsc#1256574).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the\n  Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).\n","status":"published","published":"2026-09-28T08:55:58Z","modified":"2026-09-29T09:15:07.942948517Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}