CVE-2026-15157 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-15157](https://avd.aquasec.com/nvd/cve-2026-15157) | `MEDIUM` | `undici` | `6.26.0` | `6.28.0, 7.29.0, 8.9.0` | `2026-07-29T22:16:52.463Z` | `2026-08-04T10:19:08.862184301Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |

---

## Description

> undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

---

### Remediation Steps
- Update the affected package `undici` from version `6.26.0` to `6.28.0, 7.29.0, 8.9.0`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start by locating the build inputs for public.ecr.aws/lambda/nodejs:latest and :24 and identify where undici 6.26.0 is supplied. Update it to one of the listed fixed versions, rebuild the affected images, and confirm the CVE no longer appears in the scan.

Written by the indexing model from the issue text.