node-fetch Inefficient Regular Expression Complexity

Description

node-fetch is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.

Recommendation

Update the node-fetch package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.2.10
• Patched version(s): 3.2.10

References

• GHSA-vp56-6g26-6827
• huntr.dev
• CVE-2022-2596
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) - CVE-2019-10744
• jquery-validation vulnerable to Cross-site Scripting - CVE-2025-3573
• @mozilla/readability Denial of Service through Regex - CVE-2025-2792
• ejson shell parser in MongoDB Compass maybe bypassed - CVE-2024-6376

Tags:

npm

node-fetch