{"id":"CVE-2022-0235","aliases":["ALSA-2023:0050","CLSA-2026-1775003167","CLSA-2026-1775003169","CLSA-2026-1775003170","CLSA-2026-1792449835","CLSA-2026-1793203551","DEBIAN-CVE-2022-0235","DLA-3222-1","EUVD-2022-0683","GHSA-r683-j2x4-v87g","RHSA-2023:0050","RHSA-2023:0612","RHSA-2023:1742","RLSA-2023:0050","ROOT-APP-NPM-CVE-2022-0235","SUSE-SU-2022:1459-1","SUSE-SU-2022:1461-1","SUSE-SU-2022:1462-1","SUSE-SU-2022:1466-1","SUSE-SU-2022:1694-1","SUSE-SU-2022:1717-1","UBUNTU-CVE-2022-0235","USN-6158-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01778,"percentile":0.78381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-173","CWE-200","CWE-601"],"published":"2022-01-16T00:00:00Z","modified":"2026-11-03T08:00:50Z","fixes":[{"ecosystem":"npm","package":"node-fetch","fixed_in":["3.1.1","2.6.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"node-fetch","fixed_in":["1.6.3-tuxcare.1","2.6.1-tuxcare.1","1.7.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-fetch","fixed_in":["2.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-fetch","fixed_in":["2.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-fetch","fixed_in":["2.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-fetch","fixed_in":["1.7.3-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/node-fetch","fixed_in":["2.6.1-root.io.1","2.6.1-root.io.2","1.7.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"node-fetch","fixed_in":["2.6.1-aikido.2","1.7.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-fetch","fixed_in":["1.7.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"node-fetch","fixed_in":["1.7.3-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.3-tuxcare.0"},{"fixed":"1.6.3-tuxcare.1"}]}],"versions":["1.6.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.1-tuxcare.0"},{"fixed":"2.6.1-tuxcare.1"}]}],"versions":["2.6.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.3-tuxcare.0"},{"fixed":"1.7.3-tuxcare.1"}]}],"versions":["1.7.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0-tuxcare.0"},{"fixed":"2.6.0-tuxcare.1"}]}],"versions":["2.6.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.1"}]}],"versions":["2.1.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1+deb10u1"}]}],"versions":["1.7.3-1"]},{"source":"osv","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.17-14.21.1.3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+1116+bd2a84b4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-root.io.1"},{"fixed":"2.6.1-root.io.2"},{"fixed":"1.7.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-aikido.2"},{"fixed":"1.7.3-aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-6.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-1.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-150200.10.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-150200.10.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-2ubuntu0.1"}]}],"versions":["1.7.3-1","1.7.3-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-2ubuntu0.1"}]}],"versions":["1.7.3-1","1.7.3-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"node-fetch","product":"node-fetch/node-fetch"},{"vendor":"node-fetch_project","product":"node-fetch"},{"vendor":"siemens","product":"sinec_ins"}],"references":[{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","tags":["advisory"]},{"url":"https://github.com/node-fetch/node-fetch/pull/1453","tags":["web"]},{"url":"https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","tags":["web"]},{"url":"https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","tags":["web"]},{"url":"https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r683-j2x4-v87g"},{"url":"https://access.redhat.com/errata/RHSA-2023:0050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24999","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43548","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/2150323","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0050.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0235.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0235","tags":["advisory"]},{"url":"https://github.com/node-fetch/node-fetch","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150323","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0235","tags":["advisory","report"]},{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","tags":["advisory"]},{"url":"https://github.com/expressjs/express/releases/tag/4.17.3","tags":["article"]},{"url":"https://github.com/ljharb/qs/pull/428","tags":["article"]},{"url":"https://github.com/n8tz/CVE-2022-24999","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43548","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0612","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1742","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21824","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35256","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/issues/5","tags":["article"]},{"url":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0050","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221459-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194819","tags":["report"]},{"url":"https://bugzilla.suse.com/1196877","tags":["report"]},{"url":"https://bugzilla.suse.com/1197283","tags":["report"]},{"url":"https://bugzilla.suse.com/1198247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221461-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221462-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221466-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221694-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191962","tags":["report"]},{"url":"https://bugzilla.suse.com/1191963","tags":["report"]},{"url":"https://bugzilla.suse.com/1192153","tags":["report"]},{"url":"https://bugzilla.suse.com/1192154","tags":["report"]},{"url":"https://bugzilla.suse.com/1192696","tags":["report"]},{"url":"https://bugzilla.suse.com/1194514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21824","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-0235","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6158-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0235","title":"Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T00:00:00Z","modified":"2026-10-07T17:51:24.084Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200","CWE-200"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-0683","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T00:00:00Z","modified":"2026-10-07T17:51:24Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:34.815018Z"}],"ghsa":[{"id":"GHSA-r683-j2x4-v87g","title":"node-fetch forwards secure headers to untrusted sites","description":"node-fetch forwards secure headers such as `authorization`, `www-authenticate`, `cookie`, \u0026 `cookie2` when redirecting to a untrusted site.","status":"published","published":"2022-01-21T23:55:52Z","modified":"2023-11-29T22:08:39Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-173","CWE-200","CWE-601"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2022-0235","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T17:15:07.87Z","modified":"2026-10-07T18:17:11.073Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-601"],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"CVE-2022-0235","title":"Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T00:00:00Z","modified":"2026-10-28T02:30:37.311256196Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0235","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T17:15:07.87Z","modified":"2026-11-03T08:00:50.955655816Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-r683-j2x4-v87g","title":"node-fetch forwards secure headers to untrusted sites","description":"node-fetch forwards secure headers such as `authorization`, `www-authenticate`, `cookie`, \u0026 `cookie2` when redirecting to a untrusted site.","status":"published","published":"2022-01-21T23:55:52Z","modified":"2023-11-08T04:07:30.211593Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-173","CWE-200","CWE-601"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2023:0050","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:35Z","modified":"2026-10-16T10:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0612","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-30T14:32:48Z","modified":"2026-10-16T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1742","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:46Z","modified":"2026-10-16T10:02:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T14:24:14Z","modified":"2026-02-04T20:15:13.503848Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-0235","description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","status":"published","published":"2022-01-16T17:15:00Z","modified":"2026-10-08T19:46:20.080685282Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"ALSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T00:00:00Z","modified":"2026-10-29T11:01:56.071099168Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1775003167","title":"TuxCare security update for node-fetch (1 CVE)","description":"TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:48.93061118Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775003169","title":"TuxCare security update for node-fetch (1 CVE)","description":"TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:49.148352335Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775003170","title":"TuxCare security update for node-fetch (1 CVE)","description":"TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:49.028246197Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792449835","title":"TuxCare security update for node-fetch (2 CVEs)","description":"TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.","status":"published","published":"2026-10-19T22:43:55Z","modified":"2026-10-20T01:45:16.010142132Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793203551","title":"TuxCare security update for node-fetch (2 CVEs)","description":"TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"published","published":"2026-10-28T16:05:51Z","modified":"2026-10-28T19:45:12.035416863Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-3222-1","title":"node-fetch - security update","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-03-09T01:21:13.207904Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"ROOT-APP-NPM-CVE-2022-0235","title":"CVE-2022-0235 in @rootio/node-fetch - Patched by Root","description":"Root has patched CVE-2022-0235 in the @rootio/node-fetch package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-20T12:06:41Z","modified":"2026-07-20T19:30:05.469714036Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2022:1459-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T12:38:04Z","modified":"2026-02-04T03:07:20.551845Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1461-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T14:25:18Z","modified":"2025-05-02T04:31:59.352321Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1462-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T14:46:29Z","modified":"2026-02-04T03:15:52.359531Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1466-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-29T09:42:23Z","modified":"2026-02-04T03:50:06.527285Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1694-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T07:13:45Z","modified":"2026-02-04T04:11:59.436478Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1717-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T15:43:16Z","modified":"2026-02-04T02:37:21.561016Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6158-1","title":"node-fetch vulnerability","description":"It was discovered that Node Fetch incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to obtain \nsensitive information.\n","status":"published","published":"2023-06-13T14:07:10Z","modified":"2026-10-08T19:46:44.394811691Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}