CVE-2020-15168
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/09/2020
Last modified:
17/09/2020
Description
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:* | 2.6.1 (excluding) | |
| cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta1:*:*:*:node.js:*:* | ||
| cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta5:*:*:*:node.js:*:* | ||
| cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta6:*:*:*:node.js:*:* | ||
| cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta7:*:*:*:node.js:*:* | ||
| cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta8:*:*:*:node.js:*:* |
To consult the complete list of CPE names with products and versions, see this page