Visitar URL original
Title: 🛡️ Medium Severity – Upgrade node-fetch to Prevent Information Disclosure · Issue #1850 · node-fetch/node-fetch · GitHub
Skip to content

Title: 🛡️ Medium Severity – Upgrade node-fetch to Prevent Information Disclosure  #1850

Open

Description

@iamnikhilnikki

📦 Affected Dependency Package: node-fetch Vulnerability: Information Exposure (leaking sensitive details via error messages or responses) CVE ID: CVE-2022-0235 Severity: Medium Affected Versions: <2.6.7, <3.1.1 Patched Versions: For v2.x: 2.6.7 For v3.x: 3.1.1 🧨 Description node-fetch had a flaw where certain internal response or redirect data (including URLs and headers) could be exposed in logs or responses unintentionally. This could lead to: Leaking authentication tokens, API keys, or user session data Revealing internal infrastructure URLs in error messages Assisting attackers in reconnaissance or chaining other exploits 📈 Potential Impact Internal server URLs, headers, or tokens could be exposed to logs or clients Risks increase in applications using custom fetch wrappers or verbose error logging

Activity

  1. SwhiteMHC commented on Jul 7, 2025

    @SwhiteMHC

    This is also being flagged for me as a vulnerability in my code scanning.

  2. nake89 commented on Jul 18, 2025

    @nake89

    This issue has clearly already been fixed and is not affected by using the latest version. What are the devs supposed to do with this information? (not that any devs are even working on this project, since Node.js nowadays has native fetch support)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions