Information Leak Vulnerability in node-fetch
Summary
DLA-3222-1: node-fetch - security update. Affects node-fetch versions < 1.7.3-1+deb10u1. Fixed in 1.7.3-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-fetch is a Node.js module that provides a window.fetch compatible API on the Node.js runtime. It allows developers to make HTTP requests in a simple and convenient manner. However, a vulnerability has been discovered in node-fetch that could lead to an information leak. The module did not properly enforce the same-origin policy, resulting in the leakage of cookies to the target URL when following a redirect.
Vulnerability Detail
The information leak vulnerability in node-fetch arises from its failure to adhere to the same-origin policy. When the module follows a redirect, it unintentionally leaks cookies to the target URL. This can have serious ramifications, as sensitive information stored in cookies could be exposed to unauthorized parties. Attackers could potentially exploit this vulnerability to gain access to user credentials or perform session hijacking attacks.
How To Fix
Minimum fixed version
1.7.3-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-fetchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of node-fetch to ensure the security of your application.
Conclusion
The information leak vulnerability in node-fetch can lead to the exposure of sensitive information stored in cookies. It is crucial to upgrade to the fixed version of node-fetch (1.7.3-1+deb10u1 or later) to mitigate this risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-fetch →
FAQ
node-fetch is a Node.js module that provides a window.fetch compatible API on the Node.js runtime. It allows developers to make HTTP requests in a simple and convenient manner.
The information leak vulnerability in node-fetch could result in the exposure of sensitive information stored in cookies. Attackers could potentially gain access to user credentials or perform session hijacking attacks.
To fix this vulnerability, you should upgrade your node-fetch package to version 1.7.3-1+deb10u1 or later. This version includes the necessary patches to enforce the same-origin policy and prevent the leakage of cookies.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of node-fetch to ensure the security of your application.
You can find more information about this vulnerability in the security tracker page for node-fetch at https://security-tracker.debian.org/tracker/node-fetch.
Related vulnerabilities
Recent vulnerabilities recorded for node-fetch.
