CVE-2022-2596

MediumCVSS 5.9

Published: 01/08/2022(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.30%

70th percentile - higher than 70% of all known CVEs

Summary

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. The vulnerability can lead to excessive CPU resource consumption when processing specially crafted input.

Risk Assessment

An attacker can cause resource exhaustion (CPU) and denial of service (DoS) by supplying input that triggers catastrophic regular expression backtracking. This may disrupt applications using node-fetch.

Recommendation

Upgrade node-fetch to version 3.2.10 or later. Verify that the application does not process untrusted input through vulnerable regular expressions.

Other vulnerabilities in node-fetch

CVE-2022-0235Medium
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability allows leakage of data that should be restricted.

Original NVD description (English source)

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS