high 8.8

CVE-2022-0235 json

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

published 2022-01-16 4y ago modified 2026-10-07 last mo. also GHSA-r683-j2x4-v87g , EUVD-2022-0683

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Patch / fix

fixed in 2 distros 6 links 6

npm node-fetch 2.6.7, 3.1.1
node-fetch node-fetch/node-fetch 3.1.1

debian ubuntu red hat suse almalinux rocky linux

node-fetch Debian 14, Debian 13, Debian 12 2.6.1-7

debian advisories DEBIAN-CVE-2022-0235

node-fetch Ubuntu 20.04 LTS 1.7.3-2ubuntu0.1
node-fetch Ubuntu Pro 18.04 LTS 1.7.3-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-0235

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

nodejs-packaging RHEL 8, RHEL 8.6 EUS 23-3.module+el8.3.0+6519+9f98ed83
npm RHEL 8 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47
nodejs RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17528+a329cd47
nodejs-full-i18n RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
rh-nodejs14-nodejs RHEL 3 SOFTWARE_COLLECTIONS 14.21.1-3.el7
rh-nodejs14-nodejs-nodemon RHEL 3 SOFTWARE_COLLECTIONS 2.0.20-2.el7
rh-nodejs14-npm RHEL 3 SOFTWARE_COLLECTIONS 6.14.17-14.21.1.3.el7

red hat advisories RHSA-2023:1742 RHSA-2023:0050 RHSA-2023:0612

nodejs10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +18 more 10.24.1-150000.1.44.1
nodejs8 openSUSE Leap 15.4, openSUSE Leap 15.3 8.17.0-150200.10.22.1
nodejs12 SLE Module for Web and Scripting 12 12.22.12-1.48.1
nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 14.19.1-150200.15.31.1
nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 12.22.12-150200.4.32.1
nodejs14 SLE Module for Web and Scripting 12 14.19.1-6.28.1

suse advisories SUSE-SU-2022:1717-1 SUSE-SU-2022:1694-1 SUSE-SU-2022:1466-1 SUSE-SU-2022:1462-1 SUSE-SU-2022:1461-1 SUSE-SU-2022:1459-1

npm AlmaLinux 8 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43
nodejs AlmaLinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43
nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.7.0+3373+a4c18c43
nodejs-full-i18n AlmaLinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43
nodejs-packaging AlmaLinux 8 23-3.module_el8.4.0+2522+3bd42762

almalinux advisories ALSA-2023:0050

nodejs Rocky Linux 8 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4
nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1108+49363b0d
nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c

rocky linux advisories RLSA-2023:0050

github.com/node-fetch/node-fetch@36e47e8 commit
github.com/node-fetch/node-fetch#1449 commit
github.com/node-fetch/node-fetch@1ef4b56 commit
github.com/node-fetch/node-fetch@5c32f00 commit
github.com/node-fetch/node-fetch#1453 pull request
cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf advisory

Is CVE-2022-0235 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0235 updated 2026-11-05 cvss 6.1

node-fetch: exposure of sensitive information to an unauthorized actor

Red Hat .NET Core 3.1 on Red Hat Enterprise Linux rh-dotnet31-dotnet, rh-dotnet31-dotnet-host, rh-dotnet31-dotnet-sdk-3.1, rh-dotnet31-dotnet-hostfxr-3.1, rh-dotnet31-dotnet-runtime-3.1, rh-dotnet31-dotnet-templates-3.1, +6 more
affected: no fix planned “Will not fix”
Red Hat .NET Core 5.0 on Red Hat Enterprise Linux rh-dotnet50-dotnet, rh-dotnet50-dotnet-host, rh-dotnet50-dotnet-sdk-5.0, rh-dotnet50-dotnet-hostfxr-5.0, rh-dotnet50-dotnet-runtime-5.0, rh-dotnet50-dotnet-templates-5.0, +6 more
affected: no fix planned “Out of support scope”
Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-query-rhel8
affected: no fix available
Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
affected: no fix planned “Will not fix”
Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus
affected: no fix available
Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel8
affected: no fix planned “Will not fix”
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, openshift4/ose-console, rhacm2/search-ui-rhel8, rhacm2/search-api-rhel8, rhacm2/application-ui-rhel8, rhtas/rekor-search-ui-rhel9, +3 more
affected: no fix available, no fix planned “Will not fix”
Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator
affected: no fix available

show 19 more

Red Hat Ceph Storage 3 grafana Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 dotnet, rhsm-gtk, dotnet3.1, dotnet5.0, rhsm-icons, 389-ds-base, +38 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 9 polkit, polkit-libs, thunderbird, cockpit-composer
affected: no fix available
Red Hat Fuse 7 node-fetch Red Hat Integration Camel K 1 node-fetch Red Hat Integration Camel Quarkus 1 node-fetch
affected: no fix available “Fix deferred”
Red Hat Integration Data Virtualisation Operator node-fetch Red Hat Integration Service Registry node-fetch Red Hat JBoss Data Grid 7 node-fetch Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-grafana, openshift4/ose-metering-presto, openshift4/ose-prometheus-rhel9 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
affected: no fix available
Red Hat Software Collections rh-nodejs12-npm, rh-nodejs12-nodejs Red Hat Storage 3 grafana
affected: no fix planned “Will not fix”
Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
under investigation
Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 1.36.9-1
fixed: vendor fix RHSA-2022:1739
Red Hat Data Grid 8.4.0
fixed: vendor fix RHSA-2022:8524
Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.21.1-2.module+el8.7.0+17528+a329cd47, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-2.module+el8.7.0+17528+a329cd47, npm 6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47, nodejs-full-i18n 14.21.1-2.module+el8.7.0+17528+a329cd47
fixed: vendor fix RHSA-2023:0050
Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
fixed: vendor fix RHSA-2023:1742
Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.2-9
fixed: vendor fix RHSA-2022:5483
Red Hat OpenShift Container Platform 4.11 openshift4/ose-thanos-rhel8 v4.11.0-202208020235.p0.gf08da2d.assembly.stream
fixed: vendor fix RHSA-2022:5069
Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs14-nodejs-nodemon 2.0.20-2.el7, rh-nodejs14-nodejs-full-i18n 14.21.1-3.el7
fixed: vendor fix RHSA-2023:0612
Red Hat RHINT Service Registry 2.3.0 GA
fixed: vendor fix RHSA-2022:6835
Red Hat RHODF 4.11 for RHEL 8 odf4/mcg-core-rhel8 v4.11.0-30
fixed: vendor fix RHSA-2022:6156
Red Hat RHPAM 7.13.1 async
fixed: vendor fix RHSA-2022:6813
Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-all-in-one-rhel8
not affected: vulnerable code not present

12 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-258-05 updated 2022-09-13 cvss 6.1

Siemens SINEC INS

Siemens SINEC INS <V1.0_SP2
affected: fixed in V1.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: last mo. (2026-10-07)

Exploit prediction

1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

huntr.dev https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	node-fetch	>=3.0.0, <3.1.1 <2.6.7	3.1.1 2.6.7

Affected products

node-fetch node-fetch/node-fetch

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-601 URL Redirection to Untrusted Site
CWE-173 Improper Handling of Alternate Encoding

References

github.com /node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
web, patch, third-party-advisory
cert-portal.siemens.com /productcert/pdf/ssa-637483.pdf
web, patch, third-party-advisory
github.com /node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
web
github.com /node-fetch/node-fetch/pull/1453
web
github.com /node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35
web
github.com /node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
web
huntr.dev /bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
web, exploit, third-party-advisory
lists.debian.org /debian-lts-announce/2022/12/msg00007.html
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-0235
advisory
github.com /node-fetch/node-fetch
package

Sources

CVE List CVE-2022-0235
GitHub Advisory GHSA-r683-j2x4-v87g
NVD CVE-2022-0235

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.