Credential leak in react-native-fast-image

Description

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source= is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

Recommendation

Update the react-native-fast-image package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.3.0
• Patched version(s): 8.3.0

References

• GHSA-6xhg-q9c8-rj32
• snyk.io
• CVE-2020-7696
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668
• react-native-keys insecurely stores encryption cipher and Base64 chunks - CVE-2025-45001
• Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
• LiveQuery protected field leak via shared mutable state across concurrent subscribers - CVE-2026-34363

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

react-native-fast-image