Packages / node-fetch / Security

LowVulnerabilityGHSA-w7rc-rwvf-8q5rCVE-2020-15168Published 10 Sep 2020

The `size` option isn't honored after following a redirect in node-fetch

Affected releases · node-fetch

  • 2.x2.0.0 – 2.6.0Fixed in 2.6.1

On 2.x, the newest line:

npm install node-fetch@2.6.1
3.x

  1. Not affected

    3.0.0 – 3.3.2

    17 releases, latest

2.x

  1. Affected

    2.0.0 – 2.6.0

    11 releases

  2. Fixed

    2.6.1 – 2.7.0

    14 releases

73 stable releases of node-fetch, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for node-fetch. It is read in your browser and sent nowhere.

What happens

Impact

Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Patches

We released patched versions for both stable and beta channels:

  • For v2: 2.6.1

  • For v3: 3.0.0-beta.9

Workarounds

None, it is strongly recommended to update as soon as possible.

For more information

If you have any questions or comments about this advisory:

  • Open an issue in node-fetch

  • Contact one of the core maintainers.