#2524·dva

存在漏洞依赖 node-fetch

Author: ganyanchuan1989Created Sep 29, 2025Updated Sep 29, 2025

What happens?

npm audit 检查 dva 存在安全漏洞。已经更新最新版本的[email protected] ，问题依旧存在。以下是执行 npm audit 输出的漏洞信息：

bash

                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance

 High            node-fetch forwards secure headers to untrusted sites

  Package         node-fetch

  Patched in      >=2.6.7

  Dependency of   dva

  Path            dva > isomorphic-fetch > node-fetch

  More info       https://github.com/advisories/GHSA-r683-j2x4-v87g

isomorphic-fetch 在最新版本已经更新了不存在漏洞的node-fetch的版本，请dva也同步更新一下 isomorphic-fetch 版本。

存在漏洞依赖 node-fetch

What happens?

复现步骤，错误日志以及相关配置

相关环境信息