Is CVE-2020-15168 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15168 being exploited in the wild.

How severe is CVE-2020-15168?

Low severity, with a CVSS score of 3.1, published 10 September 2020.

Which products and versions are affected?

node-fetch (npm) SEMVER:introduced=2.0.0,fixed=2.6.1.

Is there a fix for CVE-2020-15168?

Yes. node-fetch (npm): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15168 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-15168?

Check whether you run node-fetch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15168: node-fetch size limit bypass after redirect

CVE-2020-15168 · Severity: low · CVSS 3.1 · Published 2020-09-10

node-fetch is a popular JavaScript library for making HTTP requests in Node.js applications. The library failed to enforce file size limits when following HTTP redirects, allowing unexpectedly large files to be downloaded. Applications relying on this size check to prevent excessive data transfer or processing could experience denial of service or unexpected resource consumption costs.

Technologies: node-fetch (npm). Vendors: npm.

Quick answers

Is CVE-2020-15168 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15168 being exploited in the wild.
How severe is CVE-2020-15168?: Low severity, with a CVSS score of 3.1, published 10 September 2020.
Which products and versions are affected?: node-fetch (npm) SEMVER:introduced=2.0.0,fixed=2.6.1.
Is there a fix for CVE-2020-15168?: Yes. node-fetch (npm): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15168 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-15168?: Check whether you run node-fetch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-fetch (npm): upgrade to 2.6.1 or later
```
npm install node-fetch@2.6.1
```

Technical details

node-fetch did not honor the `size` option parameter after following an HTTP redirect. When an HTTP response's content size exceeded the configured limit on a redirect target, no FetchError exception was raised. This bypasses the intended input validation gate, allowing large payloads through. The vulnerability affects v2.0.0 through v2.6.0 and v3.0.0-beta.1 through v3.0.0-beta.8. The attack requires the application to follow redirects and an attacker to control a redirect target, making this a network-based attack with moderate complexity. Patched versions are available (v2.6.1 and v3.0.0-beta.9).

Affected products

node-fetch node-fetch 2.0.0–2.6.0, 3.0.0-beta.1–3.0.0-beta.8

Identifiers

CVE-2020-15168
GHSA-w7rc-rwvf-8q5r

Timeline

2020-09-10: disclosed
2020-09-10: patched: v2.6.1 and v3.0.0-beta.9 released

References

https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.