● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

Vulnerabilities Addressed

CRLF / SSRF Vector

7.5

CVSS undici

High

Backend Microservice Priority

Executive Triage und Risikobewertung

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

Kuratierte Schwachstellen-Triage-Matrix

CVE-Kennung	Subsystem / Komponente	Auswirkung	CVSS	Aktive Ausnutzung?
CVE-2024-30260	undici / global fetch()	CRLF Header Injection & SSRF	7.5 High	YES (In-The-Wild)
CVE-2024-30261	zlib Decompression	Zip Bomb ReDoS	6.2 Medium	No
CVE-2024-30262	vm Module	Context Isolation Leak	5.8 Medium	No

HERVORGEHOBENE CODE-ANALYSE

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← Sicherheitsverzeichnis durchsuchen Alle Sicherheitsupdates →