Repository navigation
v2.6.7 is reporting a high severity vulnerability #1467
Description
According to the v2.6.7 release notes it should fix a security issue but when installing that version npm is reporting that it contains a high severity vulnerability. Is there a way I can overcome this? Note that I can't upgrade to v3.x.x due to its breaking changes.
$ npm install node-fetch@2.6.7
added 3 packages, removed 5 packages, changed 1 package, and audited 351 packages in 4s
80 packages are looking for funding
run npm fund for details
1 high severity vulnerability
To address all issues (including breaking changes), run:
npm audit fix --force
Run npm audit for details.
| software | version |
|---|---|
| node-fetch | 2.6.7 |
| node | 16.13.1 |
| npm | 8.1.2 |
| Operating System | macOS 11.6 |
Activity
Pyrolistical commentedon Jan 22, 2022
Looks like a github needs to update the cve #1453 (comment)
jimmywarting commentedon Jan 22, 2022
2.6.7 is patched and safe from the attack
chore: fix a security vulnerability in `node-fetch` prior to 2.6.7
3.1.1 release (#1451)
chore: fix a security vulnerability in `node-fetch` prior to 2.6.7 (#…
fix: update `node-fetch` to 2.6.7 to fix a security vulnerability (#1072
0.36.6 (#1074)
fix: update `node-fetch` to 2.6.7 to fix a security vulnerability (#1072