Medium severity - Information Exposure vulnerability in node-fetch (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: node-fetch
• Introduced through: juice-shop@12.3.0, libxmljs2@0.26.7 and others

Detailed paths

• Introduced through: juice-shop@12.3.0 › libxmljs2@0.26.7 › @mapbox/node-pre-gyp@1.0.8 › node-fetch@2.6.6

Overview

node-fetch is a light-weight module that brings window.fetch to node.js
Affected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a Location response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.

Remediation

Upgrade node-fetch to version 2.6.7, 3.1.1 or higher.

References

• Github Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
  
  SNYK-JS-NODEFETCH-2342118
  (CVE-2022-0235,CVE-2022-1365) node-fetch@2.6.6