Skip to content
Fencer Vulns
high 8.8

CVE-2022-0235 json

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

published 2022-01-16 4 y ago modified 2026-10-07 32 d ago also GHSA-r683-j2x4-v87g , EUVD-2022-0683

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Patch / fix

  • npm node-fetch 2.6.7, 3.1.1
  • node-fetch node-fetch/node-fetch 3.1.1
  • node-fetch Debian 14, Debian 13, Debian 12 2.6.1-7

debian advisories DEBIAN-CVE-2022-0235

  • node-fetch Ubuntu 20.04 LTS 1.7.3-2ubuntu0.1
  • node-fetch Ubuntu Pro 18.04 LTS 1.7.3-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-0235

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs-packaging RHEL 8, RHEL 8.6 EUS 23-3.module+el8.3.0+6519+9f98ed83
  • npm RHEL 8 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47
  • nodejs RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
  • nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17528+a329cd47
  • nodejs-full-i18n RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
  • rh-nodejs14-nodejs RHEL 3 SOFTWARE_COLLECTIONS 14.21.1-3.el7
  • rh-nodejs14-nodejs-nodemon RHEL 3 SOFTWARE_COLLECTIONS 2.0.20-2.el7
  • rh-nodejs14-npm RHEL 3 SOFTWARE_COLLECTIONS 6.14.17-14.21.1.3.el7

red hat advisories RHSA-2023:1742RHSA-2023:0050RHSA-2023:0612

  • nodejs10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +18 more 10.24.1-150000.1.44.1
  • nodejs8 openSUSE Leap 15.4, openSUSE Leap 15.3 8.17.0-150200.10.22.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.12-1.48.1
  • nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 14.19.1-150200.15.31.1
  • nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 12.22.12-150200.4.32.1
  • nodejs14 SLE Module for Web and Scripting 12 14.19.1-6.28.1

suse advisories SUSE-SU-2022:1717-1SUSE-SU-2022:1694-1SUSE-SU-2022:1466-1SUSE-SU-2022:1462-1SUSE-SU-2022:1461-1SUSE-SU-2022:1459-1

  • npm AlmaLinux 8 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43
  • nodejs AlmaLinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43
  • nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.7.0+3373+a4c18c43
  • nodejs-full-i18n AlmaLinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43
  • nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762

almalinux advisories ALSA-2023:0050

  • nodejs Rocky Linux 8 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4
  • nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1108+49363b0d
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c

rocky linux advisories RLSA-2023:0050

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0235 updated cvss 6.1

node-fetch: exposure of sensitive information to an unauthorized actor

  • Red Hat .NET Core 3.1 on Red Hat Enterprise Linux rh-dotnet31-dotnet, rh-dotnet31-dotnet-host, rh-dotnet31-dotnet-sdk-3.1, rh-dotnet31-dotnet-hostfxr-3.1, rh-dotnet31-dotnet-runtime-3.1, rh-dotnet31-dotnet-templates-3.1, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat .NET Core 5.0 on Red Hat Enterprise Linux rh-dotnet50-dotnet, rh-dotnet50-dotnet-host, rh-dotnet50-dotnet-sdk-5.0, rh-dotnet50-dotnet-hostfxr-5.0, rh-dotnet50-dotnet-runtime-5.0, rh-dotnet50-dotnet-templates-5.0, +6 more
    affected: no fix planned “Out of support scope”
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-query-rhel8
    affected: no fix available
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, openshift4/ose-console, rhacm2/search-ui-rhel8, rhacm2/search-api-rhel8, rhacm2/application-ui-rhel8, rhtas/rekor-search-ui-rhel9, +3 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator
    affected: no fix available
show 19 more
  • Red Hat Ceph Storage 3 grafana Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 dotnet, rhsm-gtk, dotnet3.1, dotnet5.0, rhsm-icons, 389-ds-base, +38 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 polkit, polkit-libs, thunderbird, cockpit-composer
    affected: no fix available
  • Red Hat Fuse 7 node-fetch Red Hat Integration Camel K 1 node-fetch Red Hat Integration Camel Quarkus 1 node-fetch
    affected: no fix available “Fix deferred”
  • Red Hat Integration Data Virtualisation Operator node-fetch Red Hat Integration Service Registry node-fetch Red Hat JBoss Data Grid 7 node-fetch Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-grafana, openshift4/ose-metering-presto, openshift4/ose-prometheus-rhel9 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Software Collections rh-nodejs12-npm, rh-nodejs12-nodejs Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    under investigation
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 1.36.9-1
    fixed: vendor fix RHSA-2022:1739
  • Red Hat Data Grid 8.4.0
    fixed: vendor fix RHSA-2022:8524
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.21.1-2.module+el8.7.0+17528+a329cd47, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-2.module+el8.7.0+17528+a329cd47, npm 6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47, nodejs-full-i18n 14.21.1-2.module+el8.7.0+17528+a329cd47
    fixed: vendor fix RHSA-2023:0050
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
    fixed: vendor fix RHSA-2023:1742
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.2-9
    fixed: vendor fix RHSA-2022:5483
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-thanos-rhel8 v4.11.0-202208020235.p0.gf08da2d.assembly.stream
    fixed: vendor fix RHSA-2022:5069
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7
    fixed: vendor fix RHSA-2023:0612
  • Red Hat RHINT Service Registry 2.3.0 GA
    fixed: vendor fix RHSA-2022:6835
  • Red Hat RHODF 4.11 for RHEL 8 odf4/mcg-core-rhel8 v4.11.0-30
    fixed: vendor fix RHSA-2022:6156
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2022:6813
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-all-in-one-rhel8
    not affected: vulnerable code not present

12 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
32 d ago

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm node-fetch
>=3.0.0, <3.1.1
<2.6.7
3.1.1
2.6.7

Affected products

  • node-fetch node-fetch/node-fetch

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-601 URL Redirection to Untrusted Site
  • CWE-173 Improper Handling of Alternate Encoding

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.