CVE-2022-0235

MEDIUM

node-fetch < 2.6.7 and >=3.0.0 <3.1.1 - Open Redirect via URL Validation Bypass

Title source: llm

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Core 4

Core References

Mailing List, Third Party Advisory mailing-list

Patch, Third Party Advisory

Patch, Third Party Advisory

Exploit, Third Party Advisory

CVSS v3 6.1

EPSS 0.0029

EPSS Percentile 52.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-601 CWE-200

Status published

Products (5)

debian/debian_linux 10.0

node-fetch_project/node-fetch < 2.6.7

npm/node-fetch 3.0.0 - 3.1.1npm

siemens/sinec_ins 1.0 (2 CPE variants)

siemens/sinec_ins < 1.0

Published Jan 16, 2022

Tracked Since Feb 18, 2026