Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bitinn/node-fetch

              main @ 8b3320d
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

src/index.js: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

ReDoS: A ReDoS vulnerability in the referrer utilities allowed high-complexity backtracking when validating host strings, leading to service disruption. This was resolved by replacing regular expressions with fast string equality and suffix matching. Code reviews should enforce strict limits on regex utilization for user-controlled input.

Denial of Service: A memory leak on keep-alive sockets occurred when event listeners were not properly cleaned up after requests closed. This led to unbounded resource growth over time and was fixed by replacing deprecated abort listener attachment with explicit cleanup on request close.