Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-15168

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Published

2020-09-10T19:15:13.490

Last Modified

2024-11-21T05:04:59.510

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 2.6 (LOW)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-20
    CWE-770
  • Type: Primary
    CWE-770
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application node-fetch_project node-fetch < 2.6.1 Yes
Application node-fetch_project node-fetch 3.0.0 Yes
Application node-fetch_project node-fetch 3.0.0 Yes
Application node-fetch_project node-fetch 3.0.0 Yes
Application node-fetch_project node-fetch 3.0.0 Yes
Application node-fetch_project node-fetch 3.0.0 Yes
References