node-fetch Inefficient Regular Expression Complexity

Description

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.

Recommendation

Update the node-fetch package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.2.10
• Patched version(s): 3.2.10

References

• GHSA-vp56-6g26-6827
• huntr.dev
• CVE-2022-2596
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
• Inefficient Regular Expression Complexity in marked - CVE-2022-21680
• steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259
• Inefficient Regular Expression Complexity in marked (GHSA-5v2h-r2cx-5xgj) - CVE-2022-21681

Tags:

npm

node-fetch