node-fetch forwards secure headers to untrusted sites

MEDIUM 6.1CVE-2022-0235 · GHSA-r683-j2x4-v87g · Published 16/01/2022 · updated 07/10/2026

In short

CVE-2022-0235 is a MEDIUM (CVSS 6.1) vulnerability affecting node-fetch (node-fetch project), sinec ins (siemens), node-fetch.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.6% of all vulnerabilities.
Fix: update to 3.1.1, 2.6.7, 1.0 or later.

Package	Affected versions	Patched versions
node-fetch node-fetch_project	`≥ 3.0.0, < 3.1.1< 2.6.7`	`3.1.12.6.7`
sinec ins siemens	`= 1.0< 1.0`	`1.0`
node-fetch npm	`≥ 3.0.0, < 3.1.1< 2.6.7`	`3.1.12.6.7`

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.

NVD description

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 3.0.0, < 3.1.1< 2.6.7

3.1.12.6.7

= 1.0< 1.0

1.0

npm

≥ 3.0.0, < 3.1.1< 2.6.7

3.1.12.6.7

More vulnerabilities in node-fetch

See all →