Executive brief
node-fetch is a lightweight module that brings the Fetch API to Node.js applications, commonly used for HTTP requests. A flaw in how it validates URL trustworthiness allows attackers to send specially crafted URLs that cause excessive processing delays, potentially degrading application performance or causing denial of service.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the isOriginPotentiallyTrustworthy() function within referrer.js. The vulnerable regex pattern has catastrophic backtracking behavior when processing malformed URLs with alternating letters and periods (e.g., 'http://a.a.a.a...a'). The vulnerability is network-accessible and requires no authentication or user interaction—an attacker can trigger it by passing a crafted URL to the fetch function. Exploitation can cause CPU exhaustion and response delays; a 76-character payload demonstrated 42+ second execution times. The vulnerability affects versions 3.0.0 through 3.2.9 and is fixed in version 3.2.10.
Affected products
- node-fetch node-fetch 3.0.0 through 3.2.9
Timeline
- 2022-08-02: disclosed
- 2022-07-31: patched: Fixed in version 3.2.10