The `size` option isn't honored after following a redirect in node-fetch
Published 10 Sept 2020 · Updated 8 Jul 2026
Affected packages
- Affected
- >=2.0.0 <2.6.1
- Fixed in
- 2.6.1
npm install node-fetch@2.6.1- Affected
- >=3.0.0-beta.1 <3.0.0-beta.9
- Fixed in
- 3.0.0-beta.9
npm install node-fetch@3.0.0-beta.9Details
Impact
Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Patches
We released patched versions for both stable and beta channels:
- For
v2: 2.6.1 - For
v3: 3.0.0-beta.9
Workarounds
None, it is strongly recommended to update as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in node-fetch
- Contact one of the core maintainers.
Is GHSA-w7rc-rwvf-8q5r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected node-fetch, and gives you the command that fixes it.
References
- Linkgithub.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-15168
- Linkgithub.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334
- Linkgithub.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072
- Packagegithub.com/node-fetch/node-fetch
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.