node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
Release Notes
node-fetch/node-fetch (node-fetch)
### [`v2.6.7`](https://togithub.com/node-fetch/node-fetch/releases/tag/v2.6.7)
[Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7)
### Security patch release
Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred
#### What's Changed
- fix: don't forward secure headers to 3th party by [@jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1453](https://togithub.com/node-fetch/node-fetch/pull/1453)
**Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7
### [`v2.6.6`](https://togithub.com/node-fetch/node-fetch/releases/tag/v2.6.6)
[Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.5...v2.6.6)
#### What's Changed
- fix(URL): prefer built in URL version when available and fallback to whatwg by [@jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1352](https://togithub.com/node-fetch/node-fetch/pull/1352)
**Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v2.6.5...v2.6.6
### [`v2.6.5`](https://togithub.com/node-fetch/node-fetch/compare/a41c469c6164e7175f39113c875a9ddd2f064504...v2.6.5)
[Compare Source](https://togithub.com/node-fetch/node-fetch/compare/a41c469c6164e7175f39113c875a9ddd2f064504...v2.6.5)
### [`v2.6.4`](https://togithub.com/node-fetch/node-fetch/compare/v2.6.3...a41c469c6164e7175f39113c875a9ddd2f064504)
[Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.3...a41c469c6164e7175f39113c875a9ddd2f064504)
### [`v2.6.3`](https://togithub.com/node-fetch/node-fetch/compare/v2.6.2...v2.6.3)
[Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.2...v2.6.3)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
---
🐋 🤖
🔃
**A docker image for this PR is being built!**
```console
docker pull freyrcli/freyrjs-git:pr-685
```
| [**Base (master)**][base-url] | [![](https://img.shields.io/docker/image-size/freyrcli/freyrjs-git/1e13b7e?color=gray&label=%20&logo=docker)][base-url] |
| :-: | - |
---
What's this?
This docker image is a self-contained sandbox that includes all the patches made in this PR. Allowing others to easily use your patches without waiting for it to get merged and released officially.
For more context, see https://github.com/miraclx/freyr-js#docker-development.
This PR contains the following updates:
2.6.2
->2.6.7
GitHub Vulnerability Alerts
CVE-2022-0235
node-fetch forwards secure headers such as
authorization
,www-authenticate
,cookie
, &cookie2
when redirecting to a untrusted site.Release Notes
node-fetch/node-fetch (node-fetch)
### [`v2.6.7`](https://togithub.com/node-fetch/node-fetch/releases/tag/v2.6.7) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7) ### Security patch release Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred #### What's Changed - fix: don't forward secure headers to 3th party by [@jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1453](https://togithub.com/node-fetch/node-fetch/pull/1453) **Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7 ### [`v2.6.6`](https://togithub.com/node-fetch/node-fetch/releases/tag/v2.6.6) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.5...v2.6.6) #### What's Changed - fix(URL): prefer built in URL version when available and fallback to whatwg by [@jimmywarting](https://togithub.com/jimmywarting) in [https://github.com/node-fetch/node-fetch/pull/1352](https://togithub.com/node-fetch/node-fetch/pull/1352) **Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v2.6.5...v2.6.6 ### [`v2.6.5`](https://togithub.com/node-fetch/node-fetch/compare/a41c469c6164e7175f39113c875a9ddd2f064504...v2.6.5) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/a41c469c6164e7175f39113c875a9ddd2f064504...v2.6.5) ### [`v2.6.4`](https://togithub.com/node-fetch/node-fetch/compare/v2.6.3...a41c469c6164e7175f39113c875a9ddd2f064504) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.3...a41c469c6164e7175f39113c875a9ddd2f064504) ### [`v2.6.3`](https://togithub.com/node-fetch/node-fetch/compare/v2.6.2...v2.6.3) [Compare Source](https://togithub.com/node-fetch/node-fetch/compare/v2.6.2...v2.6.3)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate. View repository job log here.