Description
This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source= is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Recommendation
Update the react-native-fast-image package to the latest compatible version. Followings are version details:
- Affected version(s): < 8.3.0
- Patched version(s): 8.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Credential leak in react-native-fast-image and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular expression denial of service in react-native - CVE-2020-1920
- React Native Sms User Consent Intent Redirection Vulnerability - CVE-2021-4438
- Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891
- react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668
You might also like:
See something that needs correcting? Let us knowUpdated September 12, 2023