CVE-2022-0235
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
MEDIUM
6.1
CVSS Score
Published: January 16, 2022 at 12:00 AM UTC
Updated: October 7, 2026 at 06:17 PM UTC
4 products affected across 4 vendorsDebian LinuxSINEC INSNode Fetch
Using node-fetch/node-fetch by node-fetch?
Get instant alerts when new vulnerabilities affect node-fetch/node-fetch - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.1
Exploit prediction
EPSS 2%
SSVC
No known exploit
Description
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Debian Linux· Debiandrupal
95%v < 2.6.73.0.0 ≤ v < 3.1.1*
Affected range stops below 2.6.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.1.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.0, so it looks safe — our inference, not a vendor statement
v < 3.1.1
Affected range stops below 3.1.1, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (4)
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfPatchThird Party Advisory
Source: [email protected]
https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10ExploitThird Party Advisory
Source: [email protected]
https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7Mailing ListThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2022/12/msg00007.htmlSSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
6.1MEDIUMCISA-ADP
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-200CWE-601
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card