Headline
GHSA-vp56-6g26-6827: node-fetch Inefficient Regular Expression Complexity
node-fetch is a light-weight module that brings window.fetch to node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-2596
node-fetch Inefficient Regular Expression Complexity
Moderate severity GitHub Reviewed Published Aug 2, 2022 • Updated Aug 4, 2022
We are still processing this advisory. You may have affected repositories that are not yet on this list. Check back soon for more.
Package
npm node-fetch (npm)
Affected versions
>= 3.0.0, < 3.2.10
Description
Related news
Denial of Service in GitHub repository node-fetch/node-fetch prior to 3.2.10.