npm node-fetch vulnerabilities

Latest npm node-fetch CVEs

Newest publication first

1. CVE-2022-2596 Inefficient Regular Expression Complexity in node-fetch/node-fetch

   Published 2022-08-01

   Medium·CVSS 5.9 EPSS 1.3%

   Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.

2. CVE-2022-0235 Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

   Published 2022-01-16

   Medium·CVSS 6.1 EPSS 1.8%

   node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

3. CVE-2020-15168 File size limit bypass in node-fetch

   Published 2020-09-10

   Medium·CVSS 5.3 EPSS 1.7%

   node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.