CVE-2025-21620
HIGHdeno_fetch < 0.204.0 and deno < 2.1.2 - Authorization Header Leak via Redirect Handling
Title source: llmDescription
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6
Scores
CVSS v3
7.5
EPSS
0.0050
EPSS Percentile
38.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-200
Status
published
Products (3)
crates.io/deno
0crates.io
crates.io/deno_fetch
0.0.1 - 0.204.0crates.io
denoland/deno
< 2.1.2
Published
Jan 06, 2025
Tracked Since
Feb 18, 2026