CVE-2026-49860

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Antes de la 2.8.1, cuando se abría una conexión WebSocket, Deno verificaba el nombre de host de destino contra las reglas --deny-net, pero no volvía a verificar las direcciones IP a las que se resolvía ese nombre de host. Un script controlado por un atacante podría usar un nombre de dominio especialmente diseñado que pasara la verificación del nombre de host pero que se resolviera a una IP denegada, eludiendo por completo la restricción de red. Esta vulnerabilidad está corregida en la versión 2.8.1.

Information

Published : 2026-06-23 18:18

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49860

Mitre link : CVE-2026-49860

CVE.ORG link : CVE-2026-49860

JSON object : View

Products Affected

deno

deno

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-49860", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49860", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:37:00.680109Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": "< 2.8.1"}]}]}], "published": "2026-06-23T18:18:04.053", "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1."}, {"lang": "es", "value": "Deno es un entorno de ejecuci\u00f3n de JavaScript, TypeScript y WebAssembly. Antes de la 2.8.1, cuando se abr\u00eda una conexi\u00f3n WebSocket, Deno verificaba el nombre de host de destino contra las reglas --deny-net, pero no volv\u00eda a verificar las direcciones IP a las que se resolv\u00eda ese nombre de host. Un script controlado por un atacante podr\u00eda usar un nombre de dominio especialmente dise\u00f1ado que pasara la verificaci\u00f3n del nombre de host pero que se resolviera a una IP denegada, eludiendo por completo la restricci\u00f3n de red. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.8.1."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91F453C2-277C-4350-8234-700B47587E97", "versionEndExcluding": "2.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}