5.3

CVE-2020-15168

File size limit bypass in node-fetch

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Node-fetch Project ≫ Node-fetch SwPlatform node.js Version < 2.6.1
Node-fetch Project ≫ Node-fetch Version 3.0.0 Update beta1 SwPlatform node.js
Node-fetch Project ≫ Node-fetch Version 3.0.0 Update beta5 SwPlatform node.js
Node-fetch Project ≫ Node-fetch Version 3.0.0 Update beta6 SwPlatform node.js
Node-fetch Project ≫ Node-fetch Version 3.0.0 Update beta7 SwPlatform node.js
Node-fetch Project ≫ Node-fetch Version 3.0.0 Update beta8 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.69% 0.741
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
security-advisories@github.com 2.6 1.2 1.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r
Third Party Advisory
https://www.npmjs.com/package/node-fetch
Third Party Advisory
Product