MaxListenersExceededWarning: Possible EventEmitter memory leak detected.

[marck283]

Operating System

Windows 11

Browser Version

Google Chrome 117.0.5938.132

Firebase SDK Version

10.1.0

Firebase SDK Product:

Auth, Firestore, Functions, Storage

Describe your project's tooling

Node.js web application using Firebase tools to authenticate the user.

Describe the problem

Upgrading node-fetch to version 3.0.0 prompts a MaxListenersExceededWarning: Possible EventEmitter memory leak detected warning when a project depends on packages that depend on a version of node-fetch prior to 3.2.5. NPM's version of firebase-tools, firebase/auth, firebase/auth-compat, firebase/firestore, firebase/functions and firebase/storage all use version 2.6.7 of the package node-fetch or depend on packages that use a version of node-fetch prior to 3.2.5, which are known to be vulnerable to this MaxListenersExceededWarning. As stated here, upgrading to node-fetch@3.2.5 or later should solve the issue.

Further information on the problem can be found here.

Steps and code to reproduce issue

Upgrade Node.js to version 20.7.0 while having some packages depending on node-fetch prior to version 3.2.5.

[marck283]

As a side-note, node-fetch's versions up to 3.2.10 also suffer from Regular Expression Denial of Service (as can be seen here), making node-fetch@3.2.10 the earliest non-vulnerable version of that package.

[hsubox76]

Thanks for the detailed info. We already have it on our list to upgrade to node-fetch 3+ in response to a previous issue: #7280 but we can increase the priority of this.

[marck283]

Thank you for answering! Just in case, I have also left a comment on the PR #7359 associated to the issue #7280 which describes the proposed solution for the issues reported here.

[marck283]

Since the commit that solves this issue is now merged into the master branch, I will now close this issue.