fetch: Authorization headers not dropped when redirecting cross-origin

Summary When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. Details...

CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

Deno 信息泄露漏洞

Deno is a simple, modern and secure JavaScript and TypeScript runtime environment from Deno Open Source. An information disclosure vulnerability exists in Deno versions prior to 2.1.2, which stems from the fact that fetch redirect processing creates a subsequent redirect request that retains the...

PT-2025-4305 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 2.1.2 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When a request with the Authorization header is sent to one domain and the response asks to redirect to a different...

CVE-2025-21620: Exposure of Sensitive Information to an Unauthorized Actor

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

PT-2025-4331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an out-of-bounds access in the Linux kernel HNS3. The TQP BAR space is divided into two segments, but the hclge fetch pf reg function does not distinguish between...

Malware in bitmex-node-fetch

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-11616

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both...

CVE-2024-11616 Double-fetch heap overflow

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both...

CVE-2024-11616 Double-fetch heap overflow

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both...

PT-2024-17138 · Netskope · Netskope Endpoint Dlp

Name of the Vulnerable Software and Affected Versions: Netskope Endpoint DLP versions prior to R119 Description: A security issue arises from a double-fetch problem in the Content Control Driver of Netskope Endpoint DLP, leading to a heap overflow. This occurs because the NumberOfBytes argument t...

CVE-2024-11616: Out-of-bounds Read

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both...

Malicious code in bitmex-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc7c20df046cd10e263fa37bcda6196d91e23537ce001e8ed4b9598700ad8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11916 Malicious code in bitmex-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc7c20df046cd10e263fa37bcda6196d91e23537ce001e8ed4b9598700ad8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2024-56169

A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties such as Fort are supposed to maintain a backup cache of the remote RPKI data. This can be employed as a fallback in case a new fetch fails or yields incorrect files. However, the product currently...

BIT-NODE-MIN-2024-22025

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

hull.js Code Injection Vulnerability

Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function... in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been...

Malicious code in secure-fetch-utils-stable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3b042899a3895febb34f95a4fe1c7825c2e278bb7f8625b82b7d220e66c7b5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11084 Malicious code in secure-fetch-utils-stable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3b042899a3895febb34f95a4fe1c7825c2e278bb7f8625b82b7d220e66c7b5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in secure-fetch-utils-stable

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...