CVE-2020-15168
Description
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 2.6.1-2 |
| debian | bullseye | fixed | 2.6.1-2 |
| debian | forky | fixed | 2.6.1-2 |
| debian | sid | fixed | 2.6.1-2 |
| debian | trixie | fixed | 2.6.1-2 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | node-fetch | >=2.0.0,<2.6.1 | 2.6.1 |
| npm | node-fetch | >=3.0.0-beta.1,<3.0.0-beta.9 | 3.0.0-beta.9 |
References
- https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r
- https://nvd.nist.gov/vuln/detail/CVE-2020-15168
- https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334
- https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072
- https://github.com/node-fetch/node-fetch
- https://security-tracker.debian.org/tracker/CVE-2020-15168
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.