● Node.js Advisory · May 2026

Node.js Security Advisory: May 2026 Undici CRLF Injection Triage

Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.

Vulnerabilities Addressed

CRLF / SSRF Vector

7.5

CVSS undici

High

Backend Microservice Priority

Triagem Executiva e Veredito de Risco

Node.js patched CVE-2024-30260 in undici (the backend of globalThis.fetch). Carriage return characters in custom header values were not stripped, enabling HTTP request splitting and SSRF proxy bypass.

Matriz Curada de Triagem de Vulnerabilidades

Identificador CVE	Subsistema / Componente	Impacto	CVSS	Exploração Ativa?
CVE-2024-30260	undici / global fetch()	CRLF Header Injection & SSRF	7.5 High	YES (In-The-Wild)
CVE-2024-30261	zlib Decompression	Zip Bomb ReDoS	6.2 Medium	No
CVE-2024-30262	vm Module	Context Isolation Leak	5.8 Medium	No

ANÁLISE DE CÓDIGO EM DESTAQUE

Deep Dive: Undici CRLF Injection and SSRF Teardown →

See the JavaScript validation patch in lib/core/request.js disallowing control characters in outgoing HTTP headers.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →