CVE-2022-25896
1 advisory.
npm/passport CVE-2022-25896: medium 4.8, EPSS 1.09%
Passport vulnerable to session regeneration when a users logs in or out
Action: Upgrade passport to 0.6.0 or later.
npm i passport@0.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.0 | - |
Fixed versions
| 0.6.0 |
Sources
- osv: GHSA-v923-w3x8-wh69
- https://nvd.nist.gov/vuln/detail/CVE-2022-25896
- https://github.com/jaredhanson/passport/pull/900
- https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
- https://github.com/jaredhanson/passport
- https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631
CVE-2022-25896 · published · modified · JSON