CVE-2020-15168: 
JavaScript vulnerability analysis and mitigation

CVE-2020-15168 affects node-fetch versions before 2.6.1 and 3.0.0-beta.9. The vulnerability was discovered and disclosed in September 2020. The issue exists in the size option functionality of node-fetch, a light-weight module that brings Fetch API to Node.js (GitHub Advisory).

The vulnerability stems from node-fetch not honoring the size option after following a redirect. When content size exceeded the specified limit, the expected FetchError would not be thrown, and the process would continue without failure. The vulnerability has a CVSS v3.1 base score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The impact of this vulnerability could be significant for applications relying on node-fetch to gate files above a specific size. If the size of data isn't double-checked after fetch() completion, the JavaScript thread could get tied up processing large files, potentially leading to Denial of Service (DoS) conditions. Additionally, this could result in unexpected computing costs due to processing oversized files (GitHub Advisory).

The vulnerability is exploitable when an application uses node-fetch with size limits and follows redirects. No known active exploits have been reported in the wild. The vulnerability requires no special privileges or user interaction to exploit (NVD).

The vulnerability has been patched in versions 2.6.1 and 3.0.0-beta.9. Users are strongly recommended to upgrade to these or later versions. No workarounds are available, making it crucial to update as soon as possible (GitHub Advisory).