← All advisories

Medium severity4.8NVD Advisory· Published Jul 1, 2022· Updated Jun 17, 2026

CVE-2022-25896

CVE-2022-25896

Description

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
passportnpm	< 0.6.0	0.6.0

Affected products

3

Passport Project/Passport
cpe:2.3:a:passport_project:passport:*:*:*:*:*:node.js:*:*
Range: <0.6.0
passport/passportdescription
ghsa-coords
pkg:npm/passport
Range: < 0.6.0

Patches

Vulnerability mechanics

References

5

github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608nvdPatchThird Party AdvisoryWEB
github.com/jaredhanson/passport/pull/900nvdPatchThird Party AdvisoryWEB
snyk.io/vuln/SNYK-JS-PASSPORT-2840631nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-v923-w3x8-wh69ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-25896ghsaADVISORY

News mentions

0

No linked articles in our index yet.