Packages / node-fetch / Security

ModerateVulnerabilityGHSA-vp56-6g26-6827CVE-2022-2596Published 2 Aug 2022

node-fetch Inefficient Regular Expression Complexity

Affected releases · node-fetch

  • 3.x3.0.0 – 3.2.9Fixed in 3.2.10

On 3.x, the newest line:

npm install node-fetch@3.2.10

  1. Not affected

    0.1.0 – 2.7.0

    56 releases

  2. Affected

    3.0.0 – 3.2.9

    13 releases

  3. Fixed

    3.2.10 – 3.3.2

    4 releases, latest

73 stable releases of node-fetch, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for node-fetch. It is read in your browser and sent nowhere.

What happens

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.