CVE-2022-0235Published

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2022-0235

Published

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Source published: 16 Jan 2022 00:00:00 UTC
Source modified: 7 Oct 2026 17:51:24 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.0 · 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

euvd · EUVD-2022-0683

Published

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jan 16, 2022, 12:00:00 AM

dateUpdated: Oct 7, 2026, 5:51:24 PM

30 related source bulletins · separate from aliases

SUSE-SU-2022:1462-1: Security update for nodejs14

CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235 · CVE-2022-0778

RHSA-2022:8524: Red Hat Security Advisory: Red Hat Data Grid 8.4.0 security update

CVE-2022-0235 · CVE-2022-23647 · CVE-2022-24823 · CVE-2022-25857 · CVE-2022-38749 · CVE-2022-38750 · CVE-2022-38751 · CVE-2022-38752

RHSA-2023:0612: Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

CVE-2021-35065 · CVE-2021-44906 · CVE-2022-0235 · CVE-2022-3517 · CVE-2022-24999 · CVE-2022-43548

RHSA-2022:6156: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update

CVE-2021-23440 · CVE-2021-23566 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-1650 · CVE-2022-21698 · CVE-2022-23772 · CVE-2022-23773 · CVE-2022-23806 · CVE-2022-24675 · CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24773 · CVE-2022-24785 · CVE-2022-24921 · CVE-2022-28327 · CVE-2022-29526 · CVE-2022-29810 · CVE-2022-31129

RHSA-2022:6835: Red Hat Security Advisory: Service Registry (container images) release and security update [2.3.0.GA]

CVE-2021-22569 · CVE-2021-37136 · CVE-2021-37137 · CVE-2021-41269 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-0981 · CVE-2022-21724 · CVE-2022-23647 · CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24773 · CVE-2022-25647 · CVE-2022-25857 · CVE-2022-25858 · CVE-2022-26520 · CVE-2022-31129 · CVE-2022-37734

SUSE-SU-2022:1461-1: Security update for nodejs12

CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235 · CVE-2022-0778

RHSA-2022:6813: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.1 security update

CVE-2020-7746 · CVE-2020-36518 · CVE-2021-23436 · CVE-2021-44906 · CVE-2022-0235 · CVE-2022-0722 · CVE-2022-1365 · CVE-2022-1415 · CVE-2022-1650 · CVE-2022-2458 · CVE-2022-21363 · CVE-2022-21724 · CVE-2022-23437 · CVE-2022-23913 · CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24785 · CVE-2022-26520 · CVE-2022-31129

RHSA-2022:5069: Red Hat Security Advisory: OpenShift Container Platform 4.11.0 bug fix and security update

CVE-2021-23566 · CVE-2021-23648 · CVE-2021-41190 · CVE-2021-43565 · CVE-2021-44906 · CVE-2022-0235 · CVE-2022-21698 · CVE-2022-26945 · CVE-2022-27191 · CVE-2022-29810 · CVE-2022-30321 · CVE-2022-30322 · CVE-2022-30323

SUSE-SU-2022:1466-1: Security update for nodejs12

CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235

RHSA-2022:1715: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.10 security updates and bug fixes

CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-0613 · CVE-2022-21803 · CVE-2022-24723 · CVE-2022-24785

SUSE-SU-2022:1459-1: Security update for nodejs14

CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235 · CVE-2022-0778

RHSA-2023:0050: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

CVE-2021-44906 · CVE-2022-0235 · CVE-2022-3517 · CVE-2022-24999 · CVE-2022-43548

RHSA-2022:1083: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.8 security and container updates

CVE-2021-23518 · CVE-2021-23566 · CVE-2022-0144 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0536

RHSA-2022:5392: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.11 security updates and bug fixes

CVE-2022-0235 · CVE-2022-0536 · CVE-2022-21803 · CVE-2022-23806 · CVE-2022-24785 · CVE-2022-29526 · CVE-2022-29810

WID-SEC-W-2022-2133: JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten

CVE-2019-16869 · CVE-2019-20444 · CVE-2019-20445 · CVE-2020-7608 · CVE-2020-7789 · CVE-2021-26291 · CVE-2021-3807 · CVE-2021-44906 · CVE-2022-0235 · CVE-2022-1962 · CVE-2022-24823 · CVE-2022-25857 · CVE-2022-25878 · CVE-2022-27191 · CVE-2022-28131 · CVE-2022-30187 · CVE-2022-30633 · CVE-2022-30635

RHSA-2022:4956: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes

CVE-2021-3918 · CVE-2021-41190 · CVE-2021-43565 · CVE-2021-43816 · CVE-2021-43858 · CVE-2022-0235 · CVE-2022-0778 · CVE-2022-21803 · CVE-2022-23806 · CVE-2022-24450 · CVE-2022-24778 · CVE-2022-24785 · CVE-2022-27191 · CVE-2022-29810

RHSA-2022:1739: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update

CVE-2021-44906 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24773

RHSA-2022:1681: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes

CVE-2021-23555 · CVE-2021-43565 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-0613 · CVE-2022-1365 · CVE-2022-21803 · CVE-2022-24450 · CVE-2022-24723 · CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24773 · CVE-2022-24785

RHSA-2022:5483: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.2 security and bug fix update

CVE-2021-3807 · CVE-2022-0235 · CVE-2022-0536

RHSA-2022:1476: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

CVE-2021-23518 · CVE-2021-23566 · CVE-2021-41190 · CVE-2021-43565 · CVE-2022-0144 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0536 · CVE-2022-0778 · CVE-2022-24450 · CVE-2022-24778 · CVE-2022-27191

RHSA-2022:0735: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes

CVE-2021-3807 · CVE-2021-3918 · CVE-2021-22963 · CVE-2021-41089 · CVE-2021-41091 · CVE-2021-43565 · CVE-2021-43816 · CVE-2021-43858 · CVE-2022-0235 · CVE-2022-24450

SUSE-SU-2022:1717-1: Security update for nodejs10

CVE-2021-23343 · CVE-2021-32803 · CVE-2021-32804 · CVE-2021-3807 · CVE-2021-3918 · CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235 · CVE-2022-21824

WID-SEC-W-2022-2366: HCL BigFix: Mehrere Schwachstellen

CVE-2021-27764 · CVE-2021-44906 · CVE-2022-0122 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0355

WID-SEC-W-2022-0417: Red Hat OpenShift Service Mesh: Mehrere Schwachstellen

CVE-2022-24771 · CVE-2022-24772 · CVE-2022-24773 · CVE-2022-0235 · CVE-2022-0536 · CVE-2021-44906

WID-SEC-W-2023-0426: IBM Spectrum Protect: Mehrere Schwachstellen

CVE-2021-20373 · CVE-2021-23222 · CVE-2021-23727 · CVE-2021-29678 · CVE-2021-33026 · CVE-2021-35517 · CVE-2021-35578 · CVE-2021-36090 · CVE-2021-38926 · CVE-2021-38931 · CVE-2021-39002 · CVE-2021-4034 · CVE-2021-41617 · CVE-2021-44716 · CVE-2021-44717 · CVE-2022-0235 · CVE-2022-0391 · CVE-2022-21680 · CVE-2022-21681 · CVE-2022-22346 · CVE-2022-22348 · CVE-2022-22354 · CVE-2022-23772 · CVE-2022-23773 · CVE-2022-23806

SUSE-SU-2022:1694-1: Security update for nodejs8

CVE-2021-44906 · CVE-2021-44907 · CVE-2022-0235

RHSA-2023:1742: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

CVE-2021-35065 · CVE-2021-44531 · CVE-2021-44532 · CVE-2021-44533 · CVE-2021-44906 · CVE-2022-0235 · CVE-2022-3517 · CVE-2022-4904 · CVE-2022-21824 · CVE-2022-24999 · CVE-2022-25881 · CVE-2022-35256 · CVE-2022-38900 · CVE-2022-43548 · CVE-2023-23918 · CVE-2023-23920

ICSA-22-258-05: Siemens SINEC INS

CVE-2020-7793 · CVE-2020-12762 · CVE-2020-28168 · CVE-2020-28500 · CVE-2021-3749 · CVE-2021-4160 · CVE-2021-23337 · CVE-2021-23839 · CVE-2021-23841 · CVE-2021-25217 · CVE-2021-25220 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-0396

SSA-637483: SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2

WID-SEC-W-2022-0235: Red Hat Advanced Cluster Management: Mehrere Schwachstellen ermöglichen Privilegieneskalation

CVE-2021-22963 · CVE-2021-23566 · CVE-2021-43565 · CVE-2021-43816 · CVE-2022-0155 · CVE-2022-0235 · CVE-2022-24450

Source published: Jan 16, 2022, 12:00:00 AM (timezone not stated)
Source modified: Oct 7, 2026, 5:51:24 PM (timezone not stated)
Observed here: 9 Nov 2026 23:10:08 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd · CVE-2022-0235

Published

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-200 · CWE-601

Original publisher date fields

published: 2022-01-16T17:15:07.870

lastModified: 2026-10-07T18:17:11.073

5 source CPE criteria · context only

cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:*
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 16 Jan 2022 17:15:07 UTC
Source modified: 7 Oct 2026 18:17:11 UTC
Observed here: 24 Oct 2026 19:17:37 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Primary · 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 3.0 · [email protected] · Secondary · 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 · [email protected] · Primary · 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

osv · GHSA-r683-j2x4-v87g

Published

node-fetch forwards secure headers such as `authorization`, `www-authenticate`, `cookie`, & `cookie2` when redirecting to a untrusted site.

Source published: 21 Jan 2022 23:55:52 UTC
Source modified: 8 Nov 2023 04:07:30 UTC
Observed here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Publisher rating · HIGH