CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1

CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15157 vulnerabilities

Vulnerabilities for packages: saf, langfuse-fips, npm, kibana, actions-runner, pelias-api, prism, pulumi, vitess, renovate, langfuse, code-server...

3xhaustpi (>=0.1.3, <=0.2.1), @0x0.bug/pi-coding-agent (1.0.0) +1081 more potentially affected by CVE-2026-15157 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.3, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =0.5.1 and more Source cves: CVE-2026-15157 Source...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2158 more potentially affected by CVE-2026-15157 via undici (>=6.0.0, <=6.27.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.5.7 - @adminjs/firebase-auth 1.0.0 and more Source cves: CVE-2026-15157 Source advisory: OSV:GHSA-M8RV-5G2X-5CG5...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2158 more potentially affected by CVE-2026-15157 via undici (>=6.0.0, <=6.27.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.5.7 - @adminjs/firebase-auth 1.0.0 and more Source cves: CVE-2026-15157 Source advisory: SNYK:JS-UNDICI-18426067...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +928 more potentially affected by CVE-2026-15157 via undici (>=7.0.0, <=7.28.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.1, =0.0.5 - @agnocon/connector-http 0.1.0 and more Source cves: CVE-2026-15157 Source advisory:...

DEBIAN-CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...