CVE-2020-15168

npm/node-fetch CVE-2020-15168: low 2.6

The `size` option isn't honored after following a redirect in node-fetch

Action: Upgrade node-fetch to 2.6.1 or later.

npm i node-fetch@2.6.1

npm i node-fetch@3.0.0-beta.9

Affected

Fixed versions

Sources

• osv: GHSA-w7rc-rwvf-8q5r
• https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r
• https://nvd.nist.gov/vuln/detail/CVE-2020-15168
• https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334
• https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072
• https://github.com/node-fetch/node-fetch

CVE-2020-15168 · published 2020-09-10T17:46:21Z · modified 2026-07-08T06:00:29.567074454Z · JSON