CVE-2026-55517

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Antes de la versión 2.7.5, un programa Deno que abría una conexión WebSocket de cliente podía ser colapsado por el servidor remoto. Al manejar la respuesta de handshake de WebSocket, Deno analizaba los encabezados de respuesta Sec-WebSocket-Protocol y Sec-WebSocket-Extensions de una manera que asumía que sus bytes eran siempre ASCII imprimibles. Un encabezado de respuesta que contenía bytes ASCII no visibles (0x80-0xFF) causaba un pánico que abortaba todo el proceso Deno. Esta vulnerabilidad está corregida en la versión 2.7.5.

Information

Published : 2026-06-23 18:18

Updated : 2026-10-25 23:10

NVD link : CVE-2026-55517

Mitre link : CVE-2026-55517

CVE.ORG link : CVE-2026-55517

JSON object : View

Products Affected

deno

deno

CWE

CWE-248

Uncaught Exception

{"id": "CVE-2026-55517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55517", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:52:15.311461Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": "< 2.7.5"}]}]}], "published": "2026-06-23T18:18:09.787", "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5."}, {"lang": "es", "value": "Deno es un entorno de ejecuci\u00f3n de JavaScript, TypeScript y WebAssembly. Antes de la versi\u00f3n 2.7.5, un programa Deno que abr\u00eda una conexi\u00f3n WebSocket de cliente pod\u00eda ser colapsado por el servidor remoto. Al manejar la respuesta de handshake de WebSocket, Deno analizaba los encabezados de respuesta Sec-WebSocket-Protocol y Sec-WebSocket-Extensions de una manera que asum\u00eda que sus bytes eran siempre ASCII imprimibles. Un encabezado de respuesta que conten\u00eda bytes ASCII no visibles (0x80-0xFF) causaba un p\u00e1nico que abortaba todo el proceso Deno. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.7.5."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D23838A8-D7D0-462F-8B7D-C33526ABD5FB", "versionEndExcluding": "2.7.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}