node-fetch vulnerability issue (denial of service)
Author: GuillaumeCiscoCreated Sep 16, 2020Updated Aug 25, 2021
I'm using recompose which is great! And in my opinion far more useful than hooks (sorry about that).
Laslty snyk reported that recompose has one of its dependency as vulnerable :
[email protected] › [email protected] › [email protected] › [email protected]
node-fetch is an A light-weight module that brings window.fetch to node.js
Affected versions of this package are vulnerable to Denial of Service. Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.https://app.snyk.io/vuln/SNYK-JS-NODEFETCH-674311
What should we do for addressing this issue?
I see no occurrences of [email protected] in the package.json :/
Source: acdlite/recompose