CVE-2025-21620
Deno's authorization headers not dropped when redirecting cross-origin
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Deno's authorization headers not dropped when redirecting cross-origin
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
Reserved 2024-12-29 | Published 2025-01-06 | Updated 2025-01-07 | Assigner GitHub_MCWE-200: Exposure of Sensitive Information to an Unauthorized Actor
github.com/...d/deno/security/advisories/GHSA-f27p-cmv8-xhm6
Support options
