~ / search / GHSA-7gc6-qh9x-w6h8

GHSA-7gc6-qh9x-w6h8

Withdrawn on 2025-10-08. GitHub withdrew this advisory; it no longer applies.

Withdrawn Advisory: Incorrect Authorization in cross-fetch

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-1365

Packages

EcosystemPackageAffectedFixed in
npm cross-fetch >= 3.0.0, < 3.1.5 3.1.5
npm cross-fetch < 2.2.6 2.2.6

Details

As written in the advisory (Markdown source, shown as plain text).

## Withdrawn Advisory This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac. ## Original Description When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .

References

External links from the advisory. They lead to third-party sites.