CVE-2024-27934

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe const cvoid and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe...

CVE-2024-27935

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...

CVE-2024-37150

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...

SUSE CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

deno (>=1.5.2 <=1.31.3), deno_runtime (>=0.1.0 <=0.107.0) +12 more potentially affected by CVE-2025-21620 via deno_fetch (>=0.100.0 <=0.18.0)

denofetch CARGO version =0.100.0, =1.5.2, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.7.0, =0.4.1, =0.4.1, =0.4.1, =0.4.1, =0.4.2 - zinniaruntime =0.0.3 Source cves: CVE-2025-21620 Source advisory: OSV:GHSA-F27P-CMV8-XHM6...

deno_cli (>=0.18.0-preview4 <=0.23.0), deno_cli_snapshots (>=0.0.3 <=0.19.0) +2 more potentially affected by CVE-2025-21620 via deno (>=0.15.0 <=0.6.0)

deno CARGO version =0.15.0, =0.18.0-preview4, =0.0.3, =0.0.1, =0.23.0 Source cves: CVE-2025-21620 Source advisory: OSV:GHSA-F27P-CMV8-XHM6...

GHSA-F27P-CMV8-XHM6 fetch: Authorization headers not dropped when redirecting cross-origin

Summary When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. Details...

fetch: Authorization headers not dropped when redirecting cross-origin

Summary When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. Details...

CVE-2025-21620 Deno's authorization headers not dropped when redirecting cross-origin

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620 Deno's authorization headers not dropped when redirecting cross-origin

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

CVE-2025-21620 affects Deno’s fetch() redirect handling: when an Authorization header is sent to one domain and the response redirects to another, the follow-up request preserves the header, potentially leaking it cross-origin. The issue is confirmed in Deno and is mitigated by upgrading to versi...

CVE-2025-21620 Deno's authorization headers not dropped when redirecting cross-origin

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

Deno 信息泄露漏洞

Deno is a simple, modern and secure JavaScript and TypeScript runtime environment from Deno Open Source. An information disclosure vulnerability exists in Deno versions prior to 2.1.2, which stems from the fact that fetch redirect processing creates a subsequent redirect request that retains the...

PT-2025-4305 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 2.1.2 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When a request with the Authorization header is sent to one domain and the response asks to redirect to a different...

GHSA-H97M-WW89-6JMQ vulnerabilities

Vulnerabilities for packages: berg, convco, linkerd2-proxy, pixi, lychee, sdp-k8s-injector, cargo-audit, rye, sccache, wizer, buck2, zellij, netavark, rust-analyzer, nushell, deno, wash, rustup, linkerd2, atuin, parseable, wasmcloud, kdash, bat, shadowsocks-rust, xh, wadm, samply, geckodriver,...

CVE-2024-12224 vulnerabilities

Vulnerabilities for packages: berg, convco, linkerd2-proxy, pixi, lychee, sdp-k8s-injector, cargo-audit, rye, sccache, wizer, buck2, zellij, netavark, rust-analyzer, nushell, deno, wash, rustup, linkerd2, atuin, parseable, wasmcloud, kdash, bat, shadowsocks-rust, xh, wadm, samply, geckodriver,...

op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

GHSA-4MW5-2636-4535 op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic...