CVE-2026-15157: undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-15157 is a vulnerability in undici vulnerable to CRLF Injection via blob-like body 'type' property, rated Moderate by Microsoft, with a CVSS 3.1 base score of 4.2 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.26% probability of exploitation activity in the next 30 days, higher than 18% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-15157
- Severity
- Medium CVSS 4.2
- Microsoft severity
- Moderate
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-93
- EPSS
- 0.26% (percentile 18%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- July 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-15157 at 4.2 (temporal 4.2) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | Low |
| Integrity impact | Low |
| Availability impact | None |
Affected products (1)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 nodejs 24.18.1-1 on Azure Linux 3.0 | CBL-Mariner Releases | Security Update | 24.20.0-1 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 4.2 (MEDIUM)
- NVD weakness
- CWE-93
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| undici | before 6.28.0 |
| undici | from 7.0.0, before 7.29.0 |
| undici | from 8.0.0, before 8.9.0 |
References
- https://cna.openjsf.org/security-advisories.html (Vendor Advisory)
- https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5 (Mitigation, Vendor Advisory)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Information published. | |
| 2.0 | Information published. | |
| 3.0 | Information published. |