CVE-2020-15168: Node-fetch DoS Vulnerability via Redirect

CVE-2020-15168 Overview

CVE-2020-15168 is an improper input validation vulnerability in node-fetch, a popular Node.js module that provides a fetch API similar to the browser's window.fetch. The vulnerability occurs because node-fetch did not honor the size option after following an HTTP redirect, which means that when content size exceeded the configured limit, a FetchError would never be thrown and the process would complete without failure.

Critical Impact

Applications relying on node-fetch's size option to gate large files are vulnerable to denial of service attacks and potential cost overruns from processing unexpectedly large payloads.

Affected Products

• node-fetch versions prior to 2.6.1
• node-fetch versions 3.0.0-beta1 through 3.0.0-beta8
• Applications using node-fetch with size limits and redirect handling

Discovery Timeline

• 2020-09-10 - CVE CVE-2020-15168 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-15168

Vulnerability Analysis

The vulnerability exists in how node-fetch handles the size option when processing HTTP redirects. When a request is made with a size limit configured and the server responds with a redirect (301, 302, 303, 307, 308), node-fetch follows the redirect but fails to carry forward the original size constraint. This means the size validation that would normally trigger a FetchError when content exceeds the limit is bypassed entirely.

This behavior is particularly dangerous for applications that depend on the size option as a security control to prevent processing of unexpectedly large responses. An attacker who controls the target server or can inject redirect responses could exploit this to force the application to download and process arbitrarily large files.

The vulnerability maps to CWE-20 (Improper Input Validation) and CWE-770 (Allocation of Resources Without Limits or Throttling), as the size constraint—a critical resource allocation control—is improperly validated after redirect handling.

Root Cause

The root cause lies in the redirect handling logic within node-fetch. When constructing a new request to follow a redirect, the implementation failed to propagate the size option from the original request configuration. This oversight meant that the follow-up request operated without any size constraints, regardless of what was specified in the initial fetch call.

Attack Vector

The attack vector is network-based and requires no user interaction or privileges. An attacker can exploit this vulnerability by:

1. Setting up a malicious server that responds with an HTTP redirect to a resource serving a large payload
2. Waiting for a vulnerable application to make a request with a size limit to the attacker's server
3. The redirect causes the size limit to be discarded, allowing the large payload to be fully downloaded and processed

This can result in denial of service through CPU/memory exhaustion when the application attempts to process the oversized content, as well as increased computing costs for cloud-hosted applications that pay for bandwidth or processing.

The vulnerability manifests in the redirect handling logic where the size option is not preserved across redirect requests. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2020-15168

Indicators of Compromise

• Unusual memory consumption spikes in Node.js applications using node-fetch
• Unexpected network traffic volume from applications making HTTP requests with redirects
• Increased processing time for HTTP requests that involve redirects
• Application crashes or slowdowns correlated with external HTTP requests

Detection Strategies

• Audit package.json and package-lock.json files for node-fetch versions below 2.6.1 or beta versions prior to 3.0.0-beta.9
• Use software composition analysis (SCA) tools to identify vulnerable node-fetch dependencies
• Monitor application logs for unexpectedly large response processing after redirect operations
• Implement runtime monitoring for Node.js memory and CPU usage anomalies

Monitoring Recommendations

• Enable application performance monitoring (APM) to track memory usage patterns in Node.js processes
• Configure alerts for HTTP requests that exceed normal response size thresholds
• Monitor network egress patterns for applications that consume external HTTP resources
• Implement logging for all HTTP redirects handled by the application to identify suspicious redirect chains

How to Mitigate CVE-2020-15168

Immediate Actions Required

• Upgrade node-fetch to version 2.6.1 or later for the 2.x branch
• Upgrade node-fetch to version 3.0.0-beta.9 or later for the 3.x beta branch
• Implement secondary size validation after fetch operations complete
• Review application code to identify all uses of node-fetch with size limits

Patch Information

The node-fetch project has released patched versions that properly propagate the size option through redirect handling. Users should upgrade to:

• Version 2.6.1 for stable release users
• Version 3.0.0-beta.9 for beta users

The patch can be obtained from the NPM Package Registry. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement manual size validation after fetch completes by checking response.headers.get('content-length') before processing the body
• Add application-level limits on response body size regardless of node-fetch configuration
• Configure network-level controls to limit maximum response sizes from external sources
• Disable automatic redirect following with redirect: 'manual' and implement custom redirect handling with size preservation

# Update node-fetch to patched version
npm update node-fetch@^2.6.1

# Or for specific version installation
npm install node-fetch@2.6.1 --save

# Audit for vulnerable dependencies
npm audit fix