Is node-fetch 2.6 vulnerable?
npm · 14 releases from 2.6.0 to 2.6.13 · latest node-fetch is 3.3.2 · checked 1 Nov 2026
No known advisories in the last release
node-fetch 2.6.13, the last 2.6 release, has no known advisories. 2 advisories affect earlier 2.6.x releases, so update to 2.6.13.
Update within 2.6:
npm install node-fetch@2.6.13Fixed within 2.6.x, affecting earlier releases
node-fetch forwards secure headers to untrusted sites
- Affected
- >=3.0.0 <3.1.1 · <2.6.7
- Fixed in
- 2.6.7, 3.1.1
The `size` option isn't honored after following a redirect in node-fetch
- Affected
- >=2.0.0 <2.6.1 · >=3.0.0-beta.1 <3.0.0-beta.9
- Fixed in
- 2.6.1, 3.0.0-beta.9
Which of your client projects are still on node-fetch 2.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-fetch version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other node-fetch versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.