CVE-2020-15168 — Improper Input Validation in Project Node-fetch

CWE-20 — Improper Input ValidationCWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-400 — Uncontrolled Resource Consumption8 documents7 sources
Severity
5.3MEDIUMNVD
CNA2.6
EPSS
0.1%
top 70.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Node-fetch Project Node-fetchNode-fetch
Timeline
PublishedSep 10
Latest updateSep 24

Description

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶npmnode-fetch_project/node-fetch2.0.0 — 2.6.1+1
▶Debiannode-fetch_project/node-fetch< 2.6.1-2+3
▶CVEListV5node-fetch/node-fetch<2.6.1, >3.0.0-beta.1, <3.0.0-beta.9+1

🔴Vulnerability Details

4
OSV
The `size` option isn't honored after following a redirect in node-fetch↗2020-09-10
▶
OSV
CVE-2020-15168: node-fetch before versions 2↗2020-09-10
▶
CVEList
File size limit bypass in node-fetch↗2020-09-10
▶
GHSA
The `size` option isn't honored after following a redirect in node-fetch↗2020-09-10
▶

📋Vendor Advisories

2
Red Hat
node-fetch: size of data after fetch() JS thread leads to DoS↗2020-09-10
▶
Debian
CVE-2020-15168: node-fetch - node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option ...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-15168 node-fetch: size of data after fetch() JS thread leads to DoS↗2020-09-24
▶
CVE-2020-15168 — Improper Input Validation | cvebase