diff --git a/SPECS/nodejs/CVE-2026-15157.patch b/SPECS/nodejs/CVE-2026-15157.patch
new file mode 100644
index 00000000000..54e20717445
--- /dev/null
+++ b/SPECS/nodejs/CVE-2026-15157.patch
@@ -0,0 +1,45 @@
+From 4d2df1116da8c245ea0ebe195aced4a13853fa87 Mon Sep 17 00:00:00 2001
+From: Matteo Collina <hello@matteocollina.com>
+Date: Wed, 8 Jul 2026 11:45:53 +0000
+Subject: [PATCH] fix: validate blob body content type
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42.patch
+---
+ .../node_modules/undici/lib/dispatcher/client-h1.js | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+index ef3d38ea..e5e2924f 100644
+--- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
++++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+@@ -10,6 +10,7 @@ const {
+   RequestContentLengthMismatchError,
+   ResponseContentLengthMismatchError,
+   RequestAbortedError,
++  InvalidArgumentError,
+   HeadersTimeoutError,
+   HeadersOverflowError,
+   SocketError,
+@@ -923,8 +924,16 @@ function writeH1 (client, request) {
+     }
+     body = bodyStream.stream
+     contentLength = bodyStream.length
+-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
+-    headers.push('content-type', body.type)
++  } else if (util.isBlobLike(body) && request.contentType == null) {
++    const contentType = body.type
++    if (contentType) {
++      const contentTypeValue = `${contentType}`
++      if (!util.isValidHeaderValue(contentTypeValue)) {
++        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
++        return false
++      }
++      headers.push('content-type', contentTypeValue)
++    }
+   }
+ 
+   if (body && typeof body.read === 'function') {
+-- 
+2.45.4
+
diff --git a/SPECS/nodejs/nodejs.spec b/SPECS/nodejs/nodejs.spec
index c9dd36dc164..8445f3933ff 100644
--- a/SPECS/nodejs/nodejs.spec
+++ b/SPECS/nodejs/nodejs.spec
@@ -16,7 +16,7 @@ Name:           nodejs
 # WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
 #           The version of NPM can be found inside the sources under 'deps/npm/package.json'.
 Version:        24.18.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        BSD AND MIT AND Public Domain AND NAIST-2003 AND Artistic-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -37,6 +37,7 @@ Patch4:         CVE-2024-34064.patch
 Patch5:         CVE-2025-27516.patch
 Patch6:         CVE-2026-12151.patch
 Patch7:         CVE-2026-9679.patch
+Patch8:         CVE-2026-15157.patch
 BuildRequires:  brotli-devel
 BuildRequires:  c-ares-devel
 BuildRequires:  coreutils >= 8.22
@@ -194,6 +195,9 @@ make cctest
 %{_prefix}/lib/node_modules/*
 
 %changelog
+* Mon Aug 10 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 24.18.1-2
+- Patch for CVE-2026-15157
+
 * Thu Jul 30 2026 Aditya Singh <v-aditysing@microsoft.com> - 24.18.1-1
 - Upgrade to 24.18.1 'Krypton' (LTS) (bundled npm 11.16.0).
 - This upgrade fixes CVE-2026-56846, CVE-2026-56848, CVE-2026-58043, CVE-2026-56850, CVE-2026-58040,