CVE-2022-0235: node-fetch forwards secure headers to untrusted sites

CVE-2022-0235 · Severity: low · CVSS 3 · Published 2022-01-21

node-fetch is a popular JavaScript library used to make HTTP requests in Node.js applications. When the library processes HTTP redirects to a different domain, it incorrectly forwards sensitive headers such as authorization tokens and cookies, exposing them to untrusted sites. An attacker controlling a redirect target could steal authentication credentials or session tokens, potentially gaining unauthorized access to user accounts or sensitive data.

Technologies: node-fetch (npm). Vendors: npm.

Quick answers

Is CVE-2022-0235 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-0235 being exploited in the wild.
How severe is CVE-2022-0235?
Low severity, with a CVSS score of 3, published 21 January 2022.
Which products and versions are affected?
node-fetch (npm) SEMVER:introduced=3.0.0,fixed=3.1.1.
Is there a fix for CVE-2022-0235?
Yes. node-fetch (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0235 attacked?
It is attacked over the network.
Am I affected by CVE-2022-0235?
Check whether you run node-fetch (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • node-fetch (npm): upgrade to 3.1.1 or later
    npm install node-fetch@3.1.1

Technical details

node-fetch fails to filter sensitive HTTP headers (Authorization, WWW-Authenticate, Cookie, Cookie2) when following redirects to different domains. The vulnerability exists in versions before 2.6.7 and 3.0.0 through 3.1.0. The root cause is insufficient header validation during redirect handling—the library forwards all request headers without checking whether the redirect target is a trusted domain. An attacker can exploit this by orchestrating a redirect from a legitimate site to a malicious domain controlled by the attacker, causing the victim's browser or application to leak credentials. Patches are available in node-fetch 2.6.7 and 3.1.1 and later.

Affected products

  • node-fetch node-fetch 0 to 2.6.6, 3.0.0 to 3.1.0

Identifiers

  • CVE-2022-0235
  • GHSA-r683-j2x4-v87g

Timeline

  • 2022-01-16: disclosed: NVD publication date
  • 2022-01-21: advisory: GHSA advisory published
  • 2022-01: patched: Patches released in node-fetch 2.6.7 and 3.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.