deno_fetch

A modern runtime for JavaScript and TypeScript.

View on Cargo

View on Github

Activity

Latest release: 1w ago
Total releases: 292
Cadence: ~7 days
Last 12 months: 39

Reach

Downloads: 902.5k
Stars: 108.8k

Details

License: MIT
First release: Sep 18, 2020

Releases

Version	Released
`0.284.0` minor	Oct 21, 2026
`0.283.0` minor	Sep 16, 2026
`0.282.0` minor	Aug 27, 2026
`0.281.0` minor	Aug 06, 2026
`0.280.0` unknown	Jul 23, 2026
`0.279.0` unknown	Jul 15, 2026
`0.278.0` unknown	Jul 08, 2026
`0.277.0` unknown	Jul 01, 2026
`0.276.0` unknown	Jun 25, 2026
`0.275.0` unknown	Jun 11, 2026
`0.274.0` unknown	Jun 03, 2026
`0.273.0` unknown	May 27, 2026
`0.272.0` unknown	May 22, 2026
`0.271.0` unknown	Apr 28, 2026
`0.270.0` unknown	Apr 22, 2026
`0.269.0` unknown	Apr 09, 2026
`0.268.0` unknown	Apr 01, 2026
`0.267.0` unknown	Mar 31, 2026
`0.266.0` unknown	Mar 27, 2026
`0.265.0` unknown	Mar 25, 2026
`0.264.0` unknown	Mar 19, 2026
`0.263.0` unknown	Mar 18, 2026
`0.262.0` unknown	Mar 11, 2026
`0.261.0` unknown	Mar 05, 2026
`0.260.0` unknown	Mar 04, 2026
`0.259.0` unknown	Mar 03, 2026
`0.258.0` unknown	Feb 25, 2026
`0.257.0` unknown	Feb 25, 2026
`0.256.0` unknown	Feb 17, 2026
`0.255.0` unknown	Feb 10, 2026
`0.254.0` unknown	Feb 02, 2026
`0.253.0` unknown	Jan 29, 2026
`0.252.0` unknown	Jan 22, 2026
`0.251.0` unknown	Jan 15, 2026
`0.250.0` unknown	Jan 05, 2026
`0.249.0` unknown	Dec 20, 2025
`0.248.0` unknown	Dec 19, 2025
`0.247.0` unknown	Dec 15, 2025
`0.246.0` unknown	Dec 10, 2025
`0.245.0` unknown	Oct 30, 2025
`0.244.0` unknown	Oct 28, 2025
`0.243.0` unknown	Oct 09, 2025
`0.242.0` unknown	Oct 03, 2025
`0.241.0` unknown	Sep 24, 2025
`0.240.0` unknown	Sep 17, 2025
`0.239.0` unknown	Sep 10, 2025
`0.238.0` unknown	Aug 21, 2025
`0.237.0` unknown	Aug 13, 2025
`0.236.0` unknown	Jul 31, 2025
`0.235.0` unknown	Jul 16, 2025

1–50 of 292

Repository

denoland/deno

Forks: 6.5k
Open issues: 1.3k
Language: Rust
: 5.4/ 10

deno
typescript
javascript
rust

Dependencies (37)

Depends on

0.284.0

Used by

Supply-chain exposure

36 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2025-21620 GHSA-f27p-cmv8-xhm6 Jan 06, 2025

fetch: Authorization headers not dropped when redirecting cross-origin

7.5 / 10
High
Network Low None None Unchanged High None None

Summary

When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.

Details

The right behavior would be to drop the Authorization header instead, in this scenario. The same is generally applied to Cookie and Proxy-Authorization headers, and is done for not only host changes, but also protocol/port changes. Generally referred to as "origin".

The documentation states:

Deno does not follow the same-origin policy, because the Deno user agent currently does not have the concept of origins, and it does not have a cookie jar. This means Deno does not need to protect against leaking authenticated data cross origin

Reproduction

const ac = new AbortController() const server1 = Deno.serve({ port: 3001, signal: ac.signal }, (req) => { return new Response(null, { status: 302, headers: { 'location': 'http://localhost:3002/redirected' }, }) }) const server2 = Deno.serve({ port: 3002, signal: ac.signal }, (req) => { const body = JSON.stringify({ url: req.url, hasAuth: req.headers.has('authorization'), }) return new Response(body, { status: 200, headers: {'content-type': 'application/json'}, }) }) async function main() { const response = await fetch("http://localhost:3001/", { headers: {authorization: 'Bearer foo'} }) const body = await response.json() ac.abort() if (body.hasAuth) { console.error('ERROR: Authorization header should not be present after cross-origin redirect') } else { console.log('SUCCESS: Authorization header is not present after cross-origin redirect') } } setTimeout(main, 500)

Fixed in

0.204.0

References

https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6
https://nvd.nist.gov/vuln/detail/CVE-2025-21620
https://github.com/denoland/deno

Updated Jan 07, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 4
unknown 288

292 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More