Executive brief
node-fetch is a popular JavaScript library used to make HTTP requests in Node.js applications. When the library processes HTTP redirects to a different domain, it incorrectly forwards sensitive headers such as authorization tokens and cookies, exposing them to untrusted sites. An attacker controlling a redirect target could steal authentication credentials or session tokens, potentially gaining unauthorized access to user accounts or sensitive data.
Technical details
node-fetch fails to filter sensitive HTTP headers (Authorization, WWW-Authenticate, Cookie, Cookie2) when following redirects to different domains. The vulnerability exists in versions before 2.6.7 and 3.0.0 through 3.1.0. The root cause is insufficient header validation during redirect handling—the library forwards all request headers without checking whether the redirect target is a trusted domain. An attacker can exploit this by orchestrating a redirect from a legitimate site to a malicious domain controlled by the attacker, causing the victim's browser or application to leak credentials. Patches are available in node-fetch 2.6.7 and 3.1.1 and later.
Affected products
- node-fetch node-fetch 0 to 2.6.6, 3.0.0 to 3.1.0
Timeline
- 2022-01-16: disclosed: NVD publication date
- 2022-01-21: advisory: GHSA advisory published
- 2022-01: patched: Patches released in node-fetch 2.6.7 and 3.1.1