Read the docs
TI-2022-00171 Aliases CVE-2022-0235GHSA-r683-j2x4-v87g

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 11 fixed, 28 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-601.

Summary

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01653 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-fetch/node-fetch (node-fetch): 3.1.1node-fetch (npm): 3.1.1, 2.6.7Red Hat: 14 advisoriesRed Hat: 11 fixed, 28 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-fetchnode-fetch/node-fetchbefore 3.1.13.1.1Patch availableCNA
—node-fetch (npm)3.0.0 to before 3.1.13.1.1Patch availableGHSA-r683-j2x4-v87g
—node-fetch (npm)before 2.6.72.6.7Patch availableGHSA-r683-j2x4-v87g
  • node-fetch/node-fetch Vendornode-fetch Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
  • node-fetch (npm) Vendor— Affected 3.0.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-r683-j2x4-v87g
  • node-fetch (npm) Vendor— Affected before 2.6.7 Fixed in 2.6.7 Patch available GHSA-r683-j2x4-v87g

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:*before 2.6.7; 3.0.0 to before 3.1.1Vulnerablenode-fetch
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*before 1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*1.0 sp1VulnerableSiemens
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:* Versions before 2.6.7; 3.0.0 to before 3.1.1 Vulnerable ·node-fetch
  • cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA node-fetch/node-fetch (node-fetch) Fixed in 3.1.1
  • Fix · GHSA-r683-j2x4-v87g node-fetch (npm) Fixed in 3.1.1 Advisory →
  • Fix · GHSA-r683-j2x4-v87g node-fetch (npm) Fixed in 2.6.7 Advisory →

Red Hat 14 advisories

  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
  • RHSA-2023:0050 Released 2023-01-09 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x::nodejs:14 +19
Show 11 more Red Hat advisories
  • RHSA-2022:8524 Released 2022-11-17 · Red Hat rating Important
    Red Hat Data Grid 8.4.0 security update
    • Red Hat Data Grid 8.4.0
  • RHSA-2022:6835 Released 2022-10-06 · Red Hat rating Important
    Service Registry (container images) release and security update [2.3.0.GA]
    • RHINT Service Registry 2.3.0 GA
  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async
  • RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
  • RHSA-2022:5069 Released 2022-08-10 · Red Hat rating Important
    OpenShift Container Platform 4.11.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-alibaba-machine-controllers-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
  • RHSA-2022:5483 Released 2022-07-01 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.2 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-ui-rhel8
  • RHSA-2022:4956 Released 2022-06-09 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2022:1739 Released 2022-05-05 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.1.2.1 containers security update
    • OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
  • RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:1476 Released 2022-04-21 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:0735 Released 2022-03-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core 3.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Will not fix
.NET Core 5.0 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
Distributed Tracing Jaeger 1AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5Affected—
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 1AffectedNo fix yet: Fix deferred
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Container Storage 4Affected—
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
8Base-RHMTC-1.7Fixed RHSA-2022:5483
OpenShift Service Mesh 2.1Fixed RHSA-2022:1739
RHINT Service Registry 2.3.0 GAFixed RHSA-2022:6835
RHODF 4.11 for RHEL 8Fixed RHSA-2022:6156
RHPAM 7.13.1 asyncFixed RHSA-2022:6813
Red Hat Data Grid 8.4.0Fixed RHSA-2022:8524
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0050
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2022:5069
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0612
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0612
Not affected: 13 products
  • 8Base-RHMTC-1.7
  • Distributed Tracing Jaeger 1
  • OpenShift Service Mesh 2.1
  • RHODF 4.11 for RHEL 8
  • Red Hat A-MQ Online
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat Satellite 6
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0235
  2. 2026-10-03 Alias added: GHSA-r683-j2x4-v87g
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed

References

Exploit 1

Patch 2

Advisory 2

Other 5

  • TI-2022-02398 Inefficient Regular Expression Complexity in node-fetch/node-fetch CVSS 3.1MEDIUM 5.9
  • TI-2020-11940 File size limit bypass in node-fetch CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences