node-fetch forwards secure headers to untrusted sites

Description

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.

Recommendation

Update the node-fetch package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.6.7

  >= 3.0.0, < 3.1.1**

• Patched version(s): **2.6.7

  3.1.1**

References

• GHSA-r683-j2x4-v87g
• huntr.dev
• cert-portal.siemens.com
• lists.debian.org
• CVE-2022-0235
• CWE-173
• CWE-200
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• node-fetch Inefficient Regular Expression Complexity - CVE-2022-2596
• The `size` option isn't honored after following a redirect in node-fetch - CVE-2020-15168
• Uncontrolled Resource Consumption in node-opcua - CVE-2022-21208
• Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166

Tags:

npm

node-fetch