← Back

CVE-2026-49860

nvd nist
Published: Jun 23, 2026Modified: Jun 29, 2026

JSON object

Loading...
5.2
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Exploitability: 2.0 / Impact: 2.7
Source: security-advisories@github.com (Secondary)

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

Affected (1)

Products: Deno: Deno
Deno
1 product
Deno
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Deno
Before 2.8.1

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.