node-fetch Inefficient Regular Expression Complexity

MOYENNE 5.9CVE-2022-2596 · GHSA-vp56-6g26-6827 · Published 01/08/2022 · updated 07/10/2026

En bref

CVE-2022-2596 est une vulnérabilité MOYENNE (CVSS 5.9) touchant node-fetch (node-fetch project), node-fetch.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 71.2% des vulnérabilités.
Correctif : mettre à jour vers 3.2.10 ou plus récent.

Package	Affected versions	Patched versions
node-fetch node-fetch_project	`≥ 3.0.0, < 3.2.10`	`3.2.10`
node-fetch npm	`≥ 3.0.0, < 3.2.10`	`3.2.10`

Description

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.

NVD description

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.

References

nvd.nist.gov/vuln/detail/CVE-2022-2596 · ADVISORY
node-fetch/node-fetch#1611 · WEB
node-fetch/node-fetch commit 2880238 · WEB
node-fetch/node-fetch · PACKAGE
node-fetch/node-fetch release v3.2.10 · WEB
huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7 · WEB

Autres vulnérabilités de node-fetch

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

node-fetch

node-fetch_project

≥ 3.0.0, < 3.2.10

3.2.10

node-fetch

npm

≥ 3.0.0, < 3.2.10

3.2.10

Description

node-fetch is a light-weight module that brings window.fetch to node.js.

NVD description

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.