All node-fetch CVEs — Complete Vulnerability History

Last updated: April 1, 2026 · Data: OSV Database

node-fetch is a lightweight fetch implementation for Node.js. The main CVE is a credential exposure vulnerability when following redirects.

Full CVE history

Current safe version: 3.3.2

# Before

"node-fetch": "2.6.1"

# After

"node-fetch": "3.3.2"

Then run: npm install

node-fetch CVEs and safe versions

node-fetch is a lightweight fetch implementation for Node.js. It has had several significant CVEs related to URL handling and SSRF. Many projects have migrated to the native Node.js fetch (available since Node 18) to avoid this dependency entirely.

Known node-fetch CVEs

Fix node-fetch

# node-fetch v2 (CommonJS)
npm install node-fetch@2.7.0

# node-fetch v3 (ESM only)
npm install node-fetch@3.3.2

# Verify
npm list node-fetch

Migrate to native fetch (recommended)

Node.js 18+ includes a built-in fetch implementation. If you are on Node 18+, consider removing node-fetch entirely and using the native global fetch — one less dependency, no CVEs to track.

# Check your Node version
node --version

# If Node 18+, just use:
const response = await fetch('https://api.example.com/data');
const data = await response.json();

# Remove node-fetch from package.json
npm uninstall node-fetch