CVE-2022-0235

MediumCVSS 6.1

Published: 16/01/2022(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.65%

76th percentile - higher than 76% of all known CVEs

Summary

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability allows leakage of data that should be restricted.

Risk Assessment

An unauthorized actor may gain access to sensitive information processed by an application using node-fetch. This can lead to data leakage, including credentials or personal data.

Recommendation

Upgrade node-fetch to the latest version containing the fix for this vulnerability. Verify that the application does not transmit sensitive data in a way susceptible to leakage.

Other vulnerabilities in node-fetch

CVE-2022-2596Medium
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. The vulnerability can lead to excessive CPU resource consumption when processing specially crafted input.

Original NVD description (English source)

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability data from NVD (NIST) · CISA KEV · EPSS