The `size` option isn't honored after following a redirect in node-fetch
Impact
Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Patches
We released patched versions for both stable and beta channels:
- For
v2: 2.6.1 - For
v3: 3.0.0-beta.9
Workarounds
None, it is strongly recommended to update as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in node-fetch
- Contact one of the core maintainers.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | node-fetch | >= 2.0.0, < 2.6.1, >= 3.0.0-beta.1, < 3.0.0-beta.9 | 2.6.1, 3.0.0-beta.9 |
References
- https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r
- https://nvd.nist.gov/vuln/detail/CVE-2020-15168
- https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334
- https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072
- https://github.com/node-fetch/node-fetch
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-20, CWE-770- Platform
- npm
- Package
node-fetch- Disclosed
- 10.09.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-w7rc-rwvf-8q5r - CC BY 4.0
Vulnerability history: node-fetch
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 09.2020 08.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
- Low 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
The `size` option isn't honored after following a redirect in node-fetch this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.