PT-2025-4305 · Deno · Deno

Rexxars · Published 2025-01-06 · Updated 2025-01-07 · CVE-2025-21620

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.1.2

Description Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When a request with the Authorization header is sent to one domain and the response asks to redirect to a different domain, Deno's fetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.

Recommendations For Deno versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the fetch() function's redirect handling for sensitive requests until a patch is available. Restrict access to the fetch() API to minimize the risk of exploitation. Avoid using the Authorization header in requests that may be redirected to different domains until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-21620

GHSA-F27P-CMV8-XHM6

Affected Products

Deno

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21620.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-21620 · Security Note
• https://osv.dev/vulnerability/GHSA-f27p-cmv8-xhm6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21620 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6 · Note
• https://t.me/cvedetector/14425 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1876431889717657655 · Twitter Post
• https://t.me/cvenotify/106484 · Telegram Post
• https://t.me/latest_high_impact_cve/1748 · Telegram Post
• https://twitter.com/CVEnew/status/1876400975294181849 · Twitter Post