All the vulnerabilities related to the version 1.3.1 of the package
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization
, www-authenticate
, cookie
, & cookie2
when redirecting to a untrusted site.
Uncontrolled Resource Consumption in parse-link-header
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.