CRLF Injection

🗓️ 05 Aug 2026 10:42:14Reported by Veracode Vulnerability DatabaseType

CRLF Injection in undici enables header injection via unvalidated body type enabling smuggling.

Reporter	Title	Published	Views	Family All 184
IBM Security Bulletins	Security Bulletin: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher	9 Sep 202620:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697.	7 Sep 202605:22	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	8 Sep 202617:18	–	ibm
ATTACKERKB	CVE-2026-15157	29 Jul 202621:17	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)	18 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	18 Aug 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-15157	30 Jul 202600:00	–	nessus
Amazon	Important: nodejs24	17 Aug 202600:00	–	amazon
Amazon	Important: nodejs22	17 Aug 202600:00	–	amazon
CBLMariner	CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1	4 Sep 202621:31	–	cbl_mariner

Vulners

Node

nodejs undiciRange6.7.0–6.27.0js

nodejs undiciRange8.0.0–8.8.0js

nodejs undiciRange7.0.0-alpha.1–7.28.0js

nodejs undiciRange0.1.0–6.27.0js

nodejs undiciRange7.0.0–7.28.0js

Source	Link
github	www.github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d
github	www.github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5
github	www.github.com/nodejs/undici/releases/tag/v6.28.0
cna	www.cna.openjsf.org/security-advisories.html

17 Aug 2026 15:13Current

7.3High risk

Vulners AI Score7.3

CVSS 3.14.2 - 5.4

EPSS0.00193

SSVC