CVE-2020-7696: Information Exposure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-07-17 · updated 2026-06-17
Weakness: CWE-200

Description

This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

Affected products

react-native-fast-image: all versions

References

https://github.com/DylanVann/react-native-fast-image/issues/690
https://github.com/DylanVann/react-native-fast-image/pull/691
https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228
https://github.com/DylanVann/react-native-fast-image/issues/690
https://github.com/DylanVann/react-native-fast-image/pull/691
https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228

Get alerted when CVE-2020-7696 or the next vulnerability affects your stack