node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
References
| Link | Resource |
|---|---|
| https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r | Third Party Advisory |
| https://www.npmjs.com/package/node-fetch | Product Third Party Advisory |
| https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r | Third Party Advisory |
| https://www.npmjs.com/package/node-fetch | Product Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:04
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 2.6 |
| References | () https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r - Third Party Advisory | |
| References | () https://www.npmjs.com/package/node-fetch - Product, Third Party Advisory |
Information
Published : 2020-09-10 19:15
Updated : 2024-11-21 05:04
NVD link : CVE-2020-15168
Mitre link : CVE-2020-15168
CVE.ORG link : CVE-2020-15168
JSON object : View
Products Affected
node-fetch_project
- node-fetch