{"id":"GHSA-r683-j2x4-v87g","revision":"69a7eef8d71f4e71bd8ce4470f977a8b","records":[{"revision":"69a7eef8d71f4e71bd8ce4470f977a8b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-r683-j2x4-v87g","aliases":["CVE-2022-0235"],"title":"node-fetch forwards secure headers to untrusted sites","description":"node-fetch forwards secure headers such as `authorization`, `www-authenticate`, `cookie`, & `cookie2` when redirecting to a untrusted site.","state":0,"publishedAt":"2022-01-21T23:55:52+00:00","modifiedAt":"2023-11-08T04:07:30.211593+00:00","affected":[{"ecosystem":"npm","name":"node-fetch","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"node-fetch","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.6.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0235","https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","https://github.com/node-fetch/node-fetch/pull/1453","https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35","https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10","https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/node-fetch/node-fetch","https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7","https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html"],"sourceUrl":"https://github.com/advisories/GHSA-r683-j2x4-v87g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r683-j2x4-v87g","identifiers":["GHSA-r683-j2x4-v87g","CVE-2022-0235"]},"retained":false,"historicalAffected":[]}],"coverage":[]}