CVE-2022-0235

npm/node-fetch CVE-2022-0235: high 8.8

node-fetch forwards secure headers to untrusted sites

Action: Upgrade node-fetch to 2.6.7 or later.

npm i node-fetch@3.1.1

npm i node-fetch@2.6.7

Affected

Fixed versions

Sources

• osv: GHSA-r683-j2x4-v87g
• https://nvd.nist.gov/vuln/detail/CVE-2022-0235
• https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://github.com/node-fetch/node-fetch/pull/1453
• https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/node-fetch/node-fetch
• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html

CVE-2022-0235 · published 2022-01-21T23:55:52Z · modified 2023-11-08T04:07:30.211593Z · JSON