● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

Vulnerabilities Addressed

CRLF / SSRF Vector

7.5

CVSS undici

High

Backend Microservice Priority

Triage Eksekutif dan Penilaian Risiko

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

Matriks Triage Kerentanan Pilihan

Pengenal CVE	Subsistem / Komponen	Dampak	CVSS	Eksploitasi Aktif?
CVE-2024-30260	undici / global fetch()	CRLF Header Injection & SSRF	7.5 High	YES (In-The-Wild)
CVE-2024-30261	zlib Decompression	Zip Bomb ReDoS	6.2 Medium	No
CVE-2024-30262	vm Module	Context Isolation Leak	5.8 Medium	No

ANALISIS KODE PILIHAN

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← Jelajahi Direktori Keamanan Lengkap Semua Pembaruan Keamanan →