Update dependency node-fetch to v2.6.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
node-fetch	2.6.1 → 2.6.7

---

node-fetch forwards secure headers to untrusted sites

CVE-2022-0235 / GHSA-r683-j2x4-v87g

More information

Details

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0235
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://github.com/node-fetch/node-fetch/pull/1453
• https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html
• https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35
• https://github.com/advisories/GHSA-r683-j2x4-v87g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

node-fetch/node-fetch (node-fetch)

v2.6.7

Compare Source

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

• fix: don't forward secure headers to 3th party by @​jimmywarting in #​1453

Full Changelog: node-fetch/node-fetch@v2.6.6...v2.6.7

v2.6.6

Compare Source

What's Changed

• fix(URL): prefer built in URL version when available and fallback to whatwg by @​jimmywarting in #​1352

Full Changelog: node-fetch/node-fetch@v2.6.5...v2.6.6

v2.6.5

Compare Source

v2.6.4

Compare Source

v2.6.3

Compare Source

v2.6.2

Compare Source

fixed main path in package.json

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
simple-user-cms	Error		Mar 30, 2026 6:28pm