Node-fetch, a lightweight module bringing the Fetch API to Node.js, saw a notable update from version 3.0.0 to 3.1.0. This incremental release introduces key changes impacting developers. Most notably, version 3.1.0 adds the formdata-polyfill as a dependency, a critical addition for projects relying on the FormData interface, especially when dealing with browser-compatible code. In contrast, version 3.0.0 lacked this dependency and used a different version of the data-uri-to-buffer dependency.
Furthermore, the formdata-node dependency was updated in v3.1.0, moving from version 3.5.4 to 4.2.4, indicating potential bug fixes, performance improvements, or new features related to form data handling. The data-uri-to-buffer dependency was updated from version 3.0.1 to version 4.0.0. The newer version includes 1 more file than the old one with a bigger unpacked size.
From a developer's perspective, upgrading to 3.1.0 likely ensures better compatibility and feature parity with browser-based Fetch API expectations, simplifying cross-platform development. The updated dependencies signify improvements in handling form data and data URIs, potentially enhancing the robustness and efficiency of applications using node-fetch. While both versions share the same MIT license, author, and funding details, users should carefully evaluate the benefits of enhanced form data handling against potential compatibility issues arising from the dependency updates.
All the vulnerabilities related to the version 3.1.0 of the package
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
node-fetch Inefficient Regular Expression Complexity
node-fetch is a light-weight module that brings window.fetch to node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
