Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

deno_fetch

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    fetch: Authorization headers not dropped when redirecting cross-origin

    CVE-2025-21620 · GHSA-f27p-cmv8-xhm6

    Affected
    • crates.io deno_fetch >= 0.0.1, < 0.204.0
    Fixed in
    0.204.0· Partial vendor fix
    Issue
    When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. Details The right behavior would be to drop the Authorization header instead, in this scenario. The same is generally applied to Cookie and Proxy-Authorization headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as "origin". The documentation states: Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno does not need to protect against leaking authenticated data cross origin Reproduction

    Recommended action: Upgrade to 0.204.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →