MediumGHSA-v923-w3x8-wh69CVE-2022-25896SNYK-JS-PASSPORT-2840631

Passport vulnerable to session regeneration when a users logs in or out

Published 2 Jul 2022 · Updated 8 Jul 2026

Affected package

Affected: <0.6.0
Fixed in: 0.6.0

Update to the fixed version for your release line, for example:npm install passport@0.6.0

Details

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

Is GHSA-v923-w3x8-wh69 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected passport, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-25896
Linkgithub.com/jaredhanson/passport/pull/900
Linkgithub.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
Packagegithub.com/jaredhanson/passport
Linksnyk.io/vuln/SNYK-JS-PASSPORT-2840631

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.