CVE-2026-15157
MediumAdvisory
Published 29 Jul 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.4
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 222
- of 17,781 indexed, latest versions
- Container images
- 203
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
undici vulnerable to CRLF Injection via blob-like body 'type' property
Carried by container images the latest versions of 222 of 17,781 indexed charts deploy, on 203 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| node-undicideb | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 more | no fix listed | 9 |
| undicinpm | 4.15.0, 5.6.0, 5.11.0, 5.12.0+41 more | 6.28.0, 7.29.0, 8.9.0 | 203 |
Charts affected
222 by stars
Container images carrying it
203 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| epam/ | 21d91ad74755 | undici | 6.28.0 | 1 |
| epam/ | bd6b13695cdc | undici | 6.28.0 | 1 |
| ethereumoptimism/ | e07968a0e686 | undici | 6.28.0 | 1 |
| etherpad/ | 6020e7b57f4b | undici | 6.28.0 | 1 |
| etherpad/ | b723fe5f2594 | undici | 7.29.0 | 1 |
| ethpandaops/ | 1efa2fba6711 | undici | 6.28.0 | 1 |
| evoapicloud/ | 966625532d90 | undici | 7.29.0 | 1 |
| fallenbagel/ | 4538137bc5af | undici | 7.29.0 | 1 |
| felddy/ | 6c5e3e9ffbb0 | undici | 6.28.0 | 1 |
| foggbh/ | 8b7a2e5ecf4e | undici | 6.28.0 | 1 |
| fosrl/ | 83a55f933b4d | undici | 6.28.0 | 1 |
| ghostfolio/ | e3c6ab53e49b | undici | 7.29.0 | 1 |
| globalping/ | 8acbd23009fd | undici | 6.28.0 | 1 |
| haohanyang/ | 54f2112602ee | undici | 6.28.0 | 1 |
| haohanyang/ | f4f8fe4e21f1 | undici | 6.28.0 | 1 |
| helmforge/ | bf11156e0ab5 | undici | 6.28.0 | 1 |
| hirosystems/ | 9c98b23c1515 | undici | 6.28.0 | 1 |
| joplin/ | 3f7b852959aa | undici | 6.28.0 | 1 |
| journeyapps/ | bf46f66e5dcc | undici | 6.28.0 | 1 |
| jupyterhub/ | 3974ba945e65 | node-undici undici | no fix listed 6.28.0 | 1 |
| kitware/ | d7767d9b9da4 | undici | 6.28.0 | 1 |
| kubebb/ | fd8ecbd73213 | undici | 6.28.0 | 1 |
| langgenius/ | bf8027ddccf3 | undici | 6.28.0 | 1 |
| langgenius/ | 066035f93856 | node-undici undici | no fix listed 6.28.0 | 1 |
| langgenius/ | fca918260dd6 | node-undici undici | no fix listed 6.28.0 | 1 |
| langgenius/ | 8dd9de6b6190 | undici | 6.28.0 | 1 |
| langgenius/ | ba1dd1d0bcea | undici | 6.28.0 | 1 |
| library/ | 1ef2e532ca4d | undici | 7.29.0 | 1 |
| library/ | 2654b1e90413 | undici | 6.28.0 | 1 |
| library/ | 29773d6be407 | undici | 6.28.0 | 1 |
| library/ | 77196da4b0df | undici | 6.28.0 | 1 |
| library/ | 83f7bf209844 | undici | 6.28.0 | 1 |
| library/ | a7a268bbfb7f | undici | 6.28.0 | 1 |
| library/ | ac533a6988ee | undici | 6.28.0 | 1 |
| library/ | 04c0fc150f3a | undici | 6.28.0 | 1 |
| library/ | e67514e5d0f6 | undici | 6.28.0 | 1 |
| library/ | f5d1cc40abc1 | undici | 6.28.0 | 1 |
| louislam/ | 059b49d64739 | undici | 6.28.0 | 1 |
| louislam/ | 4c364ef96aad | undici | 6.28.0 | 1 |
| louislam/ | 91e963bfda56 | undici | 6.28.0 | 1 |
| louislam/ | 9865163f92c1 | undici | 6.28.0 | 1 |
| luligu/ | 1ec50ecd0694 | undici | 6.28.0 | 1 |
| mautic/ | eb8cc73d97e1 | undici | 6.28.0 | 1 |
| n8nio/ | 761374d4eb84 | undici | 7.29.0 | 1 |
| n8nio/ | 8b39ed5a2de9 | undici | 6.28.0 | 1 |
| n8nio/ | cfe2704ff858 | undici | 6.28.0 | 1 |
| n8nio/ | dd171d45102a | undici | 6.28.0 | 1 |
| neoskop/ | 25152b474f54 | undici | 6.28.0 | 1 |
| nocodb/ | d9516f0bf546 | undici | 7.29.0 | 1 |
| nodered/ | 10f40d0a83e7 | undici | 6.28.0 | 1 |