CVE-2020-15168 File size limit bypass in node-fetch
Attackers can bypass file size limits in node-fetch redirects, causing resource exhaustion and denial of service in applications relying on this check.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15168?
CVE-2020-15168 is a low-severity denial of service vulnerability in node-fetch, published on 10 Sep 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Which versions are affected by CVE-2020-15168?
4 open source packages ship an affected version, including node-fetch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-fetch npm | From 2.0.0 | 2.6.1 |
node-fetch npm | From 2.0.0 | 2.6.1 |
node-fetch npm | From 3.0.0-beta.1 | 3.0.0-beta.9 |
node-fetch npm | From 3.0.0-beta.1 | 3.0.0-beta.9 |
Products include Node-Fetch Project Node-Fetch.
How do I fix CVE-2020-15168?
Upgrade node-fetch to a fixed version for your release line: 2.6.1 or 3.0.0-beta.9.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-15168 being exploited?
There is no known exploitation of CVE-2020-15168 in the wild and no public exploit code.
Other vulnerabilities in node-fetch
Sources
Also known as DEBIAN-CVE-2020-15168, GHSA-w7rc-rwvf-8q5r, UBUNTU-CVE-2020-15168.