CVE-2020-15168: File size limit bypass in node-fetch

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-10 · updated 2026-06-17
Weakness: CWE-20

Description

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Affected products

node-fetch/node-fetch: before 2.6.1; 3.0.0-beta1, 3.0.0-beta5, 3.0.0-beta6, 3.0.0-beta7, 3.0.0-beta8 — fixed in 2.6.1
Npm Node-Fetch: from 2.0.0 before 2.6.1; from 3.0.0-beta.1 before 3.0.0-beta.9 — fixed in 2.6.1, 3.0.0-beta.9

How to fix

Upgrade to a fixed version: node-fetch/node-fetch 2.6.1; Npm Node-Fetch 2.6.1, 3.0.0-beta.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15168 or the next vulnerability affects your stack