CVE-2026-15157Medium· 4.2▾ Sunlitundici vulnerable to CRLF Injection via blob-like body 'type' property
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through isValidHeaderValue():
} else if (util.isBlobLike(body) && request.contentType == null && body.type) {
headers.push('content-type', body.type) // bypasses isValidHeaderValue()
}
The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled .type. Native Blob is safe because its constructor strips CRLF from .type. fetch() is unaffected because it validates via the Headers class. Ecosystem consumers that build duck-typed blob shapes from user input include form-data-encoder, formdata-polyfill, and formdata-node.
Same defect class as CVE-2022-35948 (explicit content-type sink, fixed in undici 5.8.2) and CVE-2026-1527 (upgrade option sink, fixed in 6.24.0 / 7.24.0), both closed by adding isValidHeaderValue() on their respective sinks. This branch was missed.
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
content-type header on the request options (skips the vulnerable branch).Blob (or fetch-blob) instead of a hand-rolled duck-typed object..type.fetch() instead of the non-fetch APIs.undici < 6.28.0undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Upgrade to a patched release:
undici 6.28.0undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16729Medium· 4.8undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-14643Medium· 5.9undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-13697High· 7.4undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-16728Medium· 4.8undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-9679Medium· 5.9undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
CVE-2026-6733Low· 3.7undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse