Regular Expression Denial of Service bug with node-fetch prior to version 3.2.10

[marck283]

Thanks for stopping by to let us know something could be better!

PLEASE READ: If you have a support contract with Google, please create an issue in the support console instead of filing on GitHub. This will ensure a timely response.

1. Is this a client library issue or a product issue?
   This issue is related to the client library for Node.js.

2. Did someone already solve this?

• This issue is solved in node-fetch@3.2.10.

3. Do you have a support contract?
   No.

If the support paths suggested above still do not result in a resolution, please provide the following details.

Environment details

• OS: Windows 11
• Node.js version: 20.7.0
• npm version: 10.1.0
• gax-nodejs version: 3.6.1

Steps to reproduce

1. Create a new Node.js project
2. Install node-fetch versions ranging between 3.1.0 and 3.2.9 or packages that depend on such versions of node-fetch.

This bug affects all versions of node-fetch from 3.1.0 until 3.2.9.

Making sure to follow these steps will guarantee the quickest resolution possible.

Thanks!