PT-2022-17618 · Unknown · Node-Fetch

Published 2022-08-01 · Updated 2023-07-11 · CVE-2022-2596

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-fetch versions prior to 3.2.10

Description The issue is related to Inefficient Regular Expression Complexity, which can lead to a Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function. This occurs when processing a URL string with alternating letters and periods.

Recommendations For versions prior to 3.2.10, update to version 3.2.10 or later to resolve the issue. As a temporary workaround, consider disabling the isOriginPotentiallyTrustworthy() function in referrer.js until a patch is available. Restrict access to the referrer.js module to minimize the risk of exploitation. Avoid using the isOriginPotentiallyTrustworthy() function with URL strings that may cause ReDoS until the issue is resolved.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-2596

GHSA-VP56-6G26-6827

Affected Products

Node-Fetch

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2596.json · Exploit
• 🔥 https://huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7 · Exploit
• https://github.com/node-fetch/node-fetch/commit/28802387292baee467e042e168d92597b5bbbe3d · Patch
• https://cve.org/CVERecord?id=CVE-2022-2596 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2596 · Security Note
• https://osv.dev/vulnerability/GHSA-vp56-6g26-6827 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2596 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2596 · Vendor Advisory
• https://github.com/node-fetch/node-fetch/releases/tag/v3.2.10 · Note
• https://github.com/node-fetch/node-fetch/pull/1611 · Note
• https://github.com/node-fetch/node-fetch · Note