Skip to content
OpenAdvisories
Low · 2.6 CVE-2020-15168 EUVD-2020-1335GHSA-w7rc-rwvf-8q5r

File size limit bypass in node-fetch

Published Sep 10, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Affected products

VendorProductAffectedFixed
node-fetch node-fetch <2.6.1, >3.0.0-beta.1, <3.0.0-beta.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 node-fetch 2.6.1-2 —
Debian 13 node-fetch 2.6.1-2 —
Debian 12 node-fetch 2.6.1-2 —
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS node-fetch No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS node-fetch No fix yet —
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.1 bind-formula 0.1.1603299886.60e4bcf-3.3.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 grafana-formula 0.3.0-3.3.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 prometheus-exporters-formula 0.8.0-3.16.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 prometheus-formula 0.3.0-3.3.1 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 pxe-formula 0.1.1602490840.4f32148-3.3.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 py26-compat-salt 2016.11.10-6.3.3 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 python-susemanager-retail 1.0.1602150122.f08af0a-3.3.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 salt-netapi-client 0.18.0-15.7.5 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 saltboot-formula +1 0.1.1602150122.f08af0a-3.6.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacecmd 4.1.8-4.9.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-admin 4.1.7-3.6.3 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-backend 4.1.16-4.11.5 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-branding 4.1.11-3.9.6 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-client-tools 4.1.7-4.6.4 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-java 4.1.22-3.16.4 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-search 4.1.3-3.3.7 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 spacewalk-web 4.1.19-3.9.5 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 susemanager 4.1.21-3.11.6 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 susemanager-build-keys 15.2.2-3.6.3 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 susemanager-docs_en +1 4.1-11.17.1 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 susemanager-schema 4.1.15-3.11.2 SUSE-SU-2020:3235-1
SUSE Manager Server Module 4.1 susemanager-sls 4.1.17-3.13.6 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 mgr-daemon 4.1.3-2.6.3 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 spacecmd 4.1.8-4.9.2 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 spacewalk-backend 4.1.16-4.11.5 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 spacewalk-client-tools 4.1.7-4.6.4 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 spacewalk-web 4.1.19-3.9.5 SUSE-SU-2020:3235-1
SUSE Manager Proxy Module 4.1 susemanager-build-keys 15.2.2-3.6.3 SUSE-SU-2020:3235-1

Affected packages

EcosystemPackageAffectedFixedRecord
npm node-fetch >= 2.0.0, < 2.6.1 2.6.1 GHSA-w7rc-rwvf-8q5r
npm node-fetch >= 3.0.0-beta.1, < 3.0.0-beta.9 3.0.0-beta.9 GHSA-w7rc-rwvf-8q5r

Advisories 5

References