GCVE - cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Node Fetch Project (`d9b9b723-0d05-53c4-a407-1852bb099ed9`)
Product	Node Fetch (`49a6b381-8dd4-501a-80c5-ff9fde5c3e33`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-2596`	vulnerable	2026-06-08 05:43:35.872174	Inefficient Regular Expression Complexity in node-fetch/node-fetch MEDIUM (5.9) Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. Published: 2022-08-01T14:13:20.000Z Updated: 2026-10-07T18:54:27.545Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7 https://github.com/node-fetch/node-fetch/commit/28802387292baee467e042e168d92597b5bbbe3d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0235`	vulnerable	2026-06-08 05:39:09.582959	Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch HIGH (8.8) node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Published: 2022-01-16T00:00:00.000Z Updated: 2026-10-07T17:51:24.084Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7 https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10 https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15168`	vulnerable	2026-06-08 05:19:25.413810	File size limit bypass in node-fetch LOW (2.6) node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing. Published: 2020-09-10T18:25:13.000Z Updated: 2024-08-04T13:08:22.463Z Open on db.gcve.eu Reference links https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r https://www.npmjs.com/package/node-fetch	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Node Fetch

Notes

PURL mappings

Vulnerability references

Contribute