[Snyk:Medium] node-fetch Denial of Service (DoS) (due by 03/20/2022)

[fec-jli]

Overview

node-fetch is a light-weight module that brings window.fetch to node.js

Affected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a Location response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.

https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/#issue-SNYK-JS-NODEFETCH-2342118

Introduced through:

Introduced through
Introduced through: fec-cms@1.0.0 › draft-js@0.11.7 › fbjs@2.0.0 › cross-fetch@3.0.6 › node-fetch@2.6.1

Completion criteria:

• Upgrade node-fetch to version 2.6.7, 3.1.1 or higher.

[patphongs]

The use of this is within the draft-js package, which is being used within our authenticated CMS system. Therefore, this vulnerability does not really effect us.