GHSA-r683-j2x4-v87g high
node-fetch forwards secure headers to untrusted sites
Affected range
SEMVER: introduced 3.0.0; fixed 3.1.1SEMVER: introduced 0; fixed 2.6.7Fixed versions: 3.1.1, 2.6.7
node-fetch
A light-weight module that brings Fetch API to node.js
npm latest 3.3.2 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
3.3.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
3 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-vp56-6g26-6827 moderate
node-fetch Inefficient Regular Expression Complexity
Affected range
SEMVER: introduced 3.0.0; fixed 3.2.10Fixed versions: 3.2.10
The `size` option isn't honored after following a redirect in node-fetch
Affected range
SEMVER: introduced 2.0.0; fixed 2.6.1SEMVER: introduced 3.0.0-beta.1; fixed 3.0.0-beta.9Fixed versions: 2.6.1, 3.0.0-beta.9