● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

Vulnerabilities Addressed

CRLF / SSRF Vector

7.5

CVSS undici

High

Backend Microservice Priority

Triaje Ejecutivo y Veredicto de Riesgo

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

Matriz Curada de Triaje de Vulnerabilidades

Identificador CVE	Subsistema / Componente	Impacto	CVSS	¿Explotación Activa?
CVE-2024-30260	undici / global fetch()	CRLF Header Injection & SSRF	7.5 High	YES (In-The-Wild)
CVE-2024-30261	zlib Decompression	Zip Bomb ReDoS	6.2 Medium	No
CVE-2024-30262	vm Module	Context Isolation Leak	5.8 Medium	No

ANÁLISIS DE CÓDIGO DESTACADO

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← Explorar Directorio de Seguridad Todas las Actualizaciones de Seguridad →