node-fetch
3.3.2 · 25 Jul 2023MIT121.2M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for node-fetch. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 3.3.2 | Safe from 3.2.10 | |
| 2.7.0 | 2 open advisories, worst high · last release Aug 2023, no longer updated |
- Highnode-fetch forwards secure headers to untrusted sitesGHSA-r683-j2x4-v87g · 21 Jan 2022
- 3.x3.0.0 – 3.1.0Fixed in 3.1.1
- 2.x2.0.0 – 2.6.6Fixed in 2.6.7
- 1.x and older0.1.0 – 1.7.3No fix, no longer updated · move to 2.6.7
- Moderatenode-fetch Inefficient Regular Expression Complexity GHSA-vp56-6g26-6827 · 2 Aug 2022
- 3.x3.0.0 – 3.2.9Fixed in 3.2.10
- LowThe `size` option isn't honored after following a redirect in node-fetchGHSA-w7rc-rwvf-8q5r · 10 Sep 2020
- 2.x2.0.0 – 2.6.0Fixed in 2.6.1
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.