● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

Vulnerabilities Addressed

CRLF / SSRF Vector

7.5

CVSS undici

High

Backend Microservice Priority

सुरक्षा समीक्षा और जोखिम विश्लेषण

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

संवेदनशील कमियों की विस्तृत तालिका

CVE पहचानकर्ता	सबसिस्टम / घटक	प्रभाव	CVSS	सक्रिय हमला?
CVE-2024-30260	undici / global fetch()	CRLF Header Injection & SSRF	7.5 High	YES (In-The-Wild)
CVE-2024-30261	zlib Decompression	Zip Bomb ReDoS	6.2 Medium	No
CVE-2024-30262	vm Module	Context Isolation Leak	5.8 Medium	No

सोर्स कोड का गहन विश्लेषण

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← सम्पूर्ण सुरक्षा निर्देशिका सभी सुरक्षा पैच अपडेट्स →