diff --git a/.changeset/lovely-buttons-explode.md b/.changeset/lovely-buttons-explode.md
new file mode 100644
index 0000000000..a2aa3985e1
--- /dev/null
+++ b/.changeset/lovely-buttons-explode.md
@@ -0,0 +1,5 @@
+---
+"@pnpm/fetch": patch
+---
+
+Update node-fetch to v2.6.1.
diff --git a/packages/fetch/package.json b/packages/fetch/package.json
index cd999ba5bd..e31a90a36e 100644
--- a/packages/fetch/package.json
+++ b/packages/fetch/package.json
@@ -37,7 +37,7 @@
     "@pnpm/fetching-types": "workspace:^1.0.0",
     "@pnpm/npm-registry-agent": "workspace:^3.1.0",
     "@zkochan/retry": "^0.2.0",
-    "node-fetch": "2.6.0",
+    "node-fetch": "^2.6.1",
     "node-fetch-unix": "2.3.0"
   },
   "devDependencies": {
diff --git a/packages/server/package.json b/packages/server/package.json
index e0e7c8a310..cb55e47863 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -45,7 +45,7 @@
     "is-port-reachable": "3.0.0",
     "load-json-file": "^6.2.0",
     "mz": "^2.7.0",
-    "node-fetch": "2.6.0",
+    "node-fetch": "^2.6.1",
     "tempy": "^0.6.0"
   },
   "dependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 680baf12ca..1b26a64faf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -410,7 +410,7 @@ importers:
       '@pnpm/fetching-types': 'link:../fetching-types'
       '@pnpm/npm-registry-agent': 'link:../npm-registry-agent'
       '@zkochan/retry': 0.2.0
-      node-fetch: 2.6.0
+      node-fetch: 2.6.1
       node-fetch-unix: 2.3.0
     devDependencies:
       '@pnpm/fetch': 'link:'
@@ -428,7 +428,7 @@ importers:
       '@zkochan/retry': ^0.2.0
       cpy-cli: ^3.1.1
       nock: 12.0.3
-      node-fetch: 2.6.0
+      node-fetch: ^2.6.1
       node-fetch-unix: 2.3.0
   packages/fetcher-base:
     dependencies:
@@ -2561,7 +2561,7 @@ importers:
       is-port-reachable: 3.0.0
       load-json-file: 6.2.0
       mz: 2.7.0
-      node-fetch: 2.6.0
+      node-fetch: 2.6.1
       tempy: 0.6.0
     specifiers:
       '@pnpm/client': 'workspace:^2.0.1'
@@ -2579,7 +2579,7 @@ importers:
       is-port-reachable: 3.0.0
       load-json-file: ^6.2.0
       mz: ^2.7.0
-      node-fetch: 2.6.0
+      node-fetch: ^2.6.1
       p-limit: ^3.0.2
       promise-share: ^1.0.0
       tempy: ^0.6.0
@@ -9369,11 +9369,11 @@ packages:
       node: 4.x || >=6.0.0
     resolution:
       integrity: sha512-ngVgjZl1n1dZRR8BIX/UKU3Q0cfkQ4byUVcV132xW/+zPF79sVo2td2576mzIGJibi7E0Azcx2gpy66BoV2hrg==
-  /node-fetch/2.6.0:
+  /node-fetch/2.6.1:
     engines:
       node: 4.x || >=6.0.0
     resolution:
-      integrity: sha512-8dG4H5ujfvFiqDmVu9fQ5bOHUC15JMjMY/Zumv26oOvvVJjM67KF8koCWIabKQ1GJIa9r2mMZscBq/TbdOcmNA==
+      integrity: sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==
   /node-gyp-build/4.1.1:
     dev: true
     hasBin: true