CVE-2026-49859

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Antes de la versión 2.8.1, cuando se llamaba a fetch(), Deno verificaba el nombre de host de destino contra las reglas --deny-net, pero no volvía a verificar las direcciones IP a las que se resolvía ese nombre de host. Un script controlado por un atacante podría usar un nombre de dominio especialmente diseñado que pase la verificación del nombre de host, pero que se resuelva a una IP denegada, eludiendo por completo la restricción de red. Esta vulnerabilidad está corregida en la versión 2.8.1.

Information

Published : 2026-06-23 18:18

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49859

Mitre link : CVE-2026-49859

CVE.ORG link : CVE-2026-49859

JSON object : View

Products Affected

deno

deno

CWE

CWE-693

Protection Mechanism Failure

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-49859", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49859", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T14:22:56.623204Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": "< 2.8.1"}]}]}], "published": "2026-06-23T18:18:03.927", "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1."}, {"lang": "es", "value": "Deno es un entorno de ejecuci\u00f3n de JavaScript, TypeScript y WebAssembly. Antes de la versi\u00f3n 2.8.1, cuando se llamaba a fetch(), Deno verificaba el nombre de host de destino contra las reglas --deny-net, pero no volv\u00eda a verificar las direcciones IP a las que se resolv\u00eda ese nombre de host. Un script controlado por un atacante podr\u00eda usar un nombre de dominio especialmente dise\u00f1ado que pase la verificaci\u00f3n del nombre de host, pero que se resuelva a una IP denegada, eludiendo por completo la restricci\u00f3n de red. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.8.1."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91F453C2-277C-4350-8234-700B47587E97", "versionEndExcluding": "2.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}