Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
node-fetch is a light-weight module that brings window.fetch to node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
Recommended action: Upgrade to 3.2.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
Recommended action: Upgrade to 3.1.1 or 2.6.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing. Patches We released patched versions for both stable and beta channels: - For v2: 2.6.1 - For v3: 3.0.0-beta.9 Workarounds None, it is strongly recommended to update as soon as possible. For more information If you have any questions or comments about this advisory: Open an issue in node-fetch Contact one of the core maintainers.
Recommended action: Upgrade to 3.0.0-beta.9 (pre-release) or 2.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.