Credential leak in react-native-fast-image

Overview

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source={{uri: “…”, headers: { host: “somehost.com”, authorization: “…” }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

Recommendation

Upgrade to version 8.3.0 or later

References

• CVE
• GitHub Advisory