CVE-2026-21636

CVE-2026-21636 - Node.js 权限模型 UDS/网络绕过 漏洞摘要 Node.js 权限模型 （--permission）旨在通过限制对文件系统、子进程、工作线程和网络的访问来对进程进行沙箱化。CVE-2026-21636 揭示了通过 undici/fetch（以及 net/tls）到 Unix 域套接字 和本地 TCP 地址的连接完全绕过了网络防护，即使未设置 --allow-net 也是如此。 受影响：Node.js v25（网络权限在披露时仍处于实验阶段）。 此 PoC 在 v22 上复现了该概念，其中可以观察到相同的绕过行为。 能够向在...

Budibase: SSRF via DNS rebinding in the REST datasource integration

Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...

nodejs: Nodejs network segmentation bypass

A flaw in Node.js's permission model allows Unix Domain Socket UDS connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs such as URLs or socketPath options can connect to arbitrary local sockets via net, tls, or undici/fetch...

GHSA-C76H-2CCP-4975 Use of Insufficiently Random Values in undici

Impact Undici fetch uses Math.random to choose the boundary for a multipart/form-data request. It is known that the output of Math.random can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled websit...

Use of Insufficiently Random Values in undici

Impact Undici fetch uses Math.random to choose the boundary for a multipart/form-data request. It is known that the output of Math.random can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled websit...

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

...

GHSA-9QXR-QJ54-H672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Impact If an attacker can alter the integrity option passed to fetch, they can let fetch accept requests as valid even if they have been tampered. Patches Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1...

UBUNTU-CVE-2024-24750

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling fetchurl and not consuming the incoming body or consuming it very slowing will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade...