Executive brief
react-native-fast-image is a popular image loading library used in React Native mobile applications. A flaw in the library causes HTTP headers (including authentication credentials and session tokens) set for one image request to be reused for all subsequent image requests. An attacker on the same network or controlling external services could intercept or observe these leaked credentials, potentially gaining unauthorized access to sensitive resources.
Technical details
This vulnerability is a credential exposure (CWE-200) affecting react-native-fast-image versions before 8.3.0. When an application loads an image with custom headers (e.g., for authentication or signed URLs), the library incorrectly caches and reuses those headers for all subsequent image requests, regardless of the target domain. The flaw is triggered when any image specifies custom headers; all following image requests will inherit those headers. An attacker can observe HTTP traffic or control external image endpoints to capture leaked authorization tokens, API keys, or session identifiers. The fix was implemented in version 8.3.0 to prevent header reuse across requests.
Affected products
- Dylan Vann react-native-fast-image before 8.3.0
Timeline
- 2021-05-18: disclosed
- 2021-05-18: patched: Fixed in version 8.3.0