StackPrism

npm package

node-fetch vulnerabilities by version

The latest release, 3.3.2 (Jul 25, 2023), has no known vulnerabilities. 3% of last week’s 208.7M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for node-fetch; the newest was published on Aug 2, 2022.

npm (opens in a new tab) describes it as “A light-weight module that brings Fetch API to node.js”

Latest release
3.3.2
Jul 25, 2023, no known vulnerabilities
Downloads last week
208.7M
All versions, from npm
Advisories on OSV.dev
3
Newest Aug 2, 2022
Licence
MIT
OpenSSF Scorecard
4.9/10
node-fetch/node-fetch (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
2.7.0Aug 23, 2023No known vulnerabilities95.7M
3.3.2latestJul 25, 2023No known vulnerabilities82.3M
2.6.7Jan 16, 2022No known vulnerabilities14.5M
2.6.9Jan 30, 2023No known vulnerabilities5.6M
1.7.3Sep 8, 20171 known vulnerability, worst rated critical2.8M
2.6.1Sep 5, 20201 known vulnerability, worst rated critical1.9M
2.6.11May 9, 2023No known vulnerabilities1.5M
2.6.13Aug 18, 2023No known vulnerabilities1.1M

Who is still on a vulnerable node-fetch

3% of last week’s 208.7M node-fetch downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. node-fetch doesn’t publish support dates we can check.

LineNewest releaseReleased
33.3.2Jul 25, 2023
22.7.0Aug 23, 2023
11.7.3Sep 8, 2017
0.10.1.0Jan 27, 2015

Newest advisories

The 3 most recently published, with the versions each one affects.

  1. WarningCVE-2022-2596 on OSV.dev (opens in a new tab)GHSA-vp56-6g26-6827

    node-fetch Inefficient Regular Expression Complexity

    Affects >= 3.0.0, < 3.2.10. Published Aug 2, 2022.

  2. CriticalCVE-2022-0235 on OSV.dev (opens in a new tab)GHSA-r683-j2x4-v87g

    node-fetch forwards secure headers to untrusted sites

    Affects >= 3.0.0, < 3.1.1; < 2.6.7. Published Jan 21, 2022.

  3. LowCVE-2020-15168 on OSV.dev (opens in a new tab)GHSA-w7rc-rwvf-8q5r

    The `size` option isn't honored after following a redirect in node-fetch

    Affects >= 2.0.0, < 2.6.1; >= 3.0.0-beta.1, < 3.0.0-beta.9. Published Sep 10, 2020.

Which node-fetch do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for node-fetch, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.