Packages / node-fetch / Security

HighVulnerabilityGHSA-r683-j2x4-v87gCVE-2022-0235Published 21 Jan 2022

node-fetch forwards secure headers to untrusted sites

Affected releases · node-fetch

  • 3.x3.0.0 – 3.1.0Fixed in 3.1.1
  • 2.x2.0.0 – 2.6.6Fixed in 2.6.7
  • 1.x and older0.1.0 – 1.7.3No fix, no longer updated

On 3.x, the newest line:

npm install node-fetch@3.1.1
3.x

  1. Affected

    3.0.0 – 3.1.0

    2 releases

  2. Fixed

    3.1.1 – 3.3.2

    15 releases, latest

2.x

  1. Affected

    2.0.0 – 2.6.6

    17 releases

  2. Fixed

    2.6.7 – 2.7.0

    8 releases

1.x

  1. Affected

    1.0.0 – 1.7.3

    30 releases

0.x

  1. Affected

    0.1.0

    1 release

73 stable releases of node-fetch, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for node-fetch. It is read in your browser and sent nowhere.

What happens

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.