Is node-fetch 2.0 vulnerable?
npm · 1 release from 2.0.0 to 2.0.0 · latest node-fetch is 3.3.2 · checked 1 Nov 2026
Yes: 2 known advisories
Yes. node-fetch 2.0.0, the last 2.0 release, is affected by 2 known security advisories (1 high, 1 low), including CVE-2022-0235, CVE-2020-15168. Upgrade to 2.6.7 or later to fix all of them.
npm install node-fetch@2.6.7Advisories affecting node-fetch 2.0.0
node-fetch forwards secure headers to untrusted sites
- Affected
- >=3.0.0 <3.1.1 · <2.6.7
- Fixed in
- 2.6.7, 3.1.1
The `size` option isn't honored after following a redirect in node-fetch
- Affected
- >=2.0.0 <2.6.1 · >=3.0.0-beta.1 <3.0.0-beta.9
- Fixed in
- 2.6.1, 3.0.0-beta.9
Which of your client projects are still on node-fetch 2.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-fetch version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other node-fetch versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.