GoogleOSV:GHSA-VP56-6G26-6827node-fetch Inefficient Regular Expression Complexity
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
38.1%
node-fetch is a light-weight module that brings window.fetch to node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
| CPE | Name | Operator | Version |
|---|---|---|---|
| node-fetch | ge | 3.0.0 | |
| node-fetch | lt | 3.2.10 |
References
github.com/node-fetch/node-fetch
github.com/node-fetch/node-fetch/commit/28802387292baee467e042e168d92597b5bbbe3d
github.com/node-fetch/node-fetch/pull/1611
github.com/node-fetch/node-fetch/releases/tag/v3.2.10
huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7
nvd.nist.gov/vuln/detail/CVE-2022-2596
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
38.1%