CVE-2024-37150

An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials.

• CWE-200
• CWE-706

• https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575Patch
• https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxvVendor Advisory
• https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22Not Applicable
• https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575Patch
• https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxvVendor Advisory
• https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22Not Applicable

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37145Flowise is a drag & drop user interface to build a customize…6.1
• CVE-2024-37146Flowise is a drag & drop user interface to build a customize…6.1
• CVE-2024-37147GLPI is an open-source asset and IT management software pack…4.3
• CVE-2024-37148GLPI is an open-source asset and IT management software pack…8.1
• CVE-2024-37149GLPI is an open-source asset and IT management software pack…8.8
• CVE-2024-3715The Database for Contact Form 7, WPforms, Elementor forms pl…7.2
• CVE-2024-37151Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-37152Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-37153Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…7.5
• CVE-2024-37154Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…5.3
• CVE-2024-37155OpenCTI is an open source platform allowing organizations to…8.2
• CVE-2024-37156The SuluFormBundle adds support for creating dynamic forms i…6.1