Executive brief
node-fetch is a popular JavaScript library for making HTTP requests in Node.js applications. The library failed to enforce file size limits when following HTTP redirects, allowing unexpectedly large files to be downloaded. Applications relying on this size check to prevent excessive data transfer or processing could experience denial of service or unexpected resource consumption costs.
Technical details
node-fetch did not honor the `size` option parameter after following an HTTP redirect. When an HTTP response's content size exceeded the configured limit on a redirect target, no FetchError exception was raised. This bypasses the intended input validation gate, allowing large payloads through. The vulnerability affects v2.0.0 through v2.6.0 and v3.0.0-beta.1 through v3.0.0-beta.8. The attack requires the application to follow redirects and an attacker to control a redirect target, making this a network-based attack with moderate complexity. Patched versions are available (v2.6.1 and v3.0.0-beta.9).
Affected products
- node-fetch node-fetch 2.0.0–2.6.0, 3.0.0-beta.1–3.0.0-beta.8
Timeline
- 2020-09-10: disclosed
- 2020-09-10: patched: v2.6.1 and v3.0.0-beta.9 released