CVE-2025-21620 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
A vulnerability exists in Deno's fetch() redirect handling, where the Authorization header is not properly managed during cross-origin redirects. When a request with an Authorization header is sent to one domain and the response redirects to a different domain, Deno retains the original Authorization header in the follow-up request. This behavior leaks the header's content to the second domain, contrary to the expected behavior of dropping the Authorization header in such scenarios. The issue arises because Deno does not adhere to the same-origin policy and lacks a cookie jar, leading to unintentional leakage of authenticated data across origins. This vulnerability affects Deno versions prior to 1.46.4 and 2.1.2, as well as deno_fetch versions 0.204.0 and through 0.0.1.
Users can upgrade to Deno version 2.1.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 6, 2025CISA-ADP
Assessed Jan 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Deno | < 1.46.4 (semver) < 2.1.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 6, 2025 | New CVE Received | [email protected] |