SB2026072967 - Multiple vulnerabilities in undici

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072967

SB2026072967 - Multiple vulnerabilities in undici

Published: July 29, 2026

Security Bulletin ID SB2026072967
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) CRLF injection (CVE-ID: CVE-2026-15157)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.

The vulnerability exists due to improper neutralization of CRLF sequences in lib/dispatcher/client-h1.js when processing a duck-typed blob-like body with an untrusted .type property through the HTTP/1.1 dispatcher. A remote attacker can supply crafted CRLF sequences in the .type value to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.

User interaction is required because exploitation occurs when an application passes untrusted input into a blob-like body's .type property. Native Blob is not affected, and fetch() is unaffected.


2) Interpretation Conflict (CVE-ID: CVE-2026-14643)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to interpretation conflict in the cache interceptor when processing Cache-Control directives with optional whitespace around the = character. A remote attacker can send requests that cause authenticated responses to be stored and later served to another caller to disclose sensitive information.

Only applications that explicitly enable shared cache mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives are vulnerable.


3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-16728)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause downstream response desynchronization, connection hangs, or response corruption.

The vulnerability exists due to inconsistent interpretation of HTTP response framing in interceptors.retry() when retrying or resuming a partial upstream response. A remote attacker can send a partial response with mismatched framing headers to cause downstream response desynchronization, connection hangs, or response corruption.

The issue requires interceptors.retry() to be enabled and a downstream forwarder that forwards upstream headers and bodies without removing or recalculating Content-Length.


4) Use of Web Browser Cache Containing Sensitive Information (CVE-ID: CVE-2026-13697)

CWE-ID: CWE-525 - Use of Web Browser Cache Containing Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cache handling in the cache interceptor when processing malformed qualified Cache-Control private directives in shared cache mode. A remote attacker can cause an upstream response with a malformed private directive to be stored in the shared cache and served to a later caller with the same cache key to disclose sensitive information.

Exploitation requires shared cache mode, a later request matching the same cache key, and no separating Vary header.


5) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-16729)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass cookie security protections and modify cookie attributes.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the setCookie function when processing user-controlled domain or unparsed setCookie fields. A remote attacker can supply crafted input containing cookie attributes to bypass cookie security protections and modify cookie attributes.

Exploitation requires an application to pass user-controlled input to these fields, such as in multi-tenant or reverse-proxy deployments.


Remediation

Install update from vendor's website.

References