TI-2025-15580 Aliases CVE-2025-21620 GHSA-f27p-cmv8-xhm6

Deno's authorization headers not dropped when redirecting cross-origin

HIGH 66CWE-200Published 2025-01-06 · Updated 2025-01-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00522 44th percentileScored 2026-11-07

Fix Fixed deno (denoland): 2.1.2deno_fetch (crates.io): 0.204.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	before 2.1.2	2.1.2	Patch available	CNA
—	deno_fetch (crates.io)	0.0.1 to before 0.204.0	0.204.0	Patch available	GHSA-f27p-cmv8-xhm6
—	deno (crates.io)	up to 1.46.3	—	No fix listed	GHSA-f27p-cmv8-xhm6
—	deno (crates.io)	2.0.0 to before 2.1.2	2.1.2	Patch available	GHSA-f27p-cmv8-xhm6

deno Vendordenoland Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
deno_fetch (crates.io) Vendor— Affected 0.0.1 to before 0.204.0 Fixed in 0.204.0 Patch available GHSA-f27p-cmv8-xhm6
deno (crates.io) Vendor— Affected up to 1.46.3 Fixed in — No fix listed GHSA-f27p-cmv8-xhm6
deno (crates.io) Vendor— Affected 2.0.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-f27p-cmv8-xhm6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno::::::::	—	—	denoland

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions — — ·denoland

Remediation

Fix · CNA deno (denoland) Fixed in 2.1.2
Fix · GHSA-f27p-cmv8-xhm6 deno_fetch (crates.io) Fixed in 0.204.0 Advisory →
Fix · GHSA-f27p-cmv8-xhm6 deno (crates.io) Fixed in 2.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-21620
2026-10-03 Alias added: GHSA-f27p-cmv8-xhm6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-21620

Other 2

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences