CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-21620

creationtimestamp| type| source ---|---|--- 2025-01-06 22:28:57+00:00| seen| https://infosec.exchange/users/cve/statuses/113783769484392065 2025-01-06 22:36:55+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/260 2025-01-06 23:15:40+00:00| seen|...

basejmp (0.1.0), clarinet (>=0.2.0, <=0.10.0) +15 more potentially affected by CVE-2025-21620 via deno_fetch (>=0.2.0, <=0.123.0)

denofetch CARGO version =0.2.0, =0.2.0, =1.4.2, =0.1.0, =0.55.0, =0.1.0, =1.12.2, =0.1.1, =0.2.0-rc1, =0.4.1, =0.4.1, =0.4.1, =0.4.2 and more Source cves: CVE-2025-21620 Source advisory: OSV:GHSA-F27P-CMV8-XHM6...

CVE-2025-21620 Deno's authorization headers not dropped when redirecting cross-origin

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...