● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

4
Vulnerabilities Addressed
1
CRLF / SSRF Vector
7.5
CVSS undici
High
Backend Microservice Priority

セキュリティトリアージとリスク評価

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

優先脆弱性トリアージマトリックス

CVE識別番号 対象サブシステム / コンポーネント 影響範囲 CVSS ゼロデイ悪用確認？
CVE-2024-30260undici / global fetch()CRLF Header Injection & SSRF7.5 HighYES (In-The-Wild)
CVE-2024-30261zlib DecompressionZip Bomb ReDoS6.2 MediumNo
CVE-2024-30262vm ModuleContext Isolation Leak5.8 MediumNo
注目ソースコード分析

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← セキュリティディレクトリ一覧 すべてのセキュリティ更新情報 →