Vulnerabilities

TI-2026-40063 CVE-2026-55517 · GHSA-x2qc-cmh9-f4hf

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

LOW 20

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00315 Published 2026-06-23 Fixed in 2.7.5 CWE-248

TI-2026-32613 CVE-2026-44726 · GHSA-chqv-56wv-7564

Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

MEDIUM 41

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00234 Published 2026-06-23 Fixed in 2.7.8 CWE-319

TI-2026-36566 CVE-2026-49401 · GHSA-8xpq-cjcf-3wh9

Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

LOW 36

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00197 Published 2026-06-23 Fixed in 2.7.14 CWE-176

TI-2026-36567 CVE-2026-49402 · GHSA-7xh3-mhg9-jcw8

Deno: Command Injection via spawnSync & spawn on Windows

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00445 Published 2026-06-23 Fixed in 2.7.10 CWE-78

TI-2026-36568 CVE-2026-49406 · GHSA-968w-xfqw-vp9q

Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00176 Published 2026-06-23 Fixed in 2.7.12 CWE-22

TI-2026-36569 CVE-2026-49411 · GHSA-v8fw-85r8-5m23

Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

MEDIUM 62

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00158 Published 2026-06-23 Fixed in 2.8.0 CWE-284

TI-2026-36816 CVE-2026-49983 · GHSA-4c8g-jvcx-v4hv

Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.0014 Published 2026-06-23 Fixed in 2.8.1 CWE-863

TI-2026-36764 CVE-2026-49860 · GHSA-83pc-3rw9-qpwj

Deno: WebSocket API sandbox bypass via missing post-DNS check

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00141 Published 2026-06-23 Fixed in 2.8.1 CWE-918

TI-2026-36763 CVE-2026-49859 · GHSA-cpgj-f7g3-2pp2

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

LOW 23

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00141 Published 2026-06-23 Fixed in 2.8.1 CWE-693

TI-2026-36596 CVE-2026-49440 · GHSA-9xg4-qhm4-g43w

Deno: Miller-Rabin Primality Test Allows Zero Rounds

LOW 34

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00237 Published 2026-06-23 Fixed in 2.8.1 CWE-325

TI-2026-24789 CVE-2026-32260 · GHSA-4c96-w8v2-p28j

Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)

MEDIUM 46

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01635 Published 2026-03-12 Fixed in 2.7.2 CWE-78

TI-2026-21627 CVE-2026-27190 · GHSA-hmh4-3xvx-q5hr

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

HIGH 76

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0246 Published 2026-02-20 Fixed in 2.6.8 CWE-78

TI-2026-18356 CVE-2026-22864 · GHSA-m3c4-prhw-mrx6

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

MEDIUM 44

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2026-01-15 Fixed in 2.5.6 CWE-77

TI-2026-18355 CVE-2026-22863 · GHSA-5379-f5hf-w38v

Deno node:crypto doesn't finalize cipher

MEDIUM 45

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00204 Published 2026-01-15 Fixed in 2.6.0 CWE-325

TI-2025-38180 CVE-2025-61787 · GHSA-m2gf-x3f6-8hq3

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

HIGH 70

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02084 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 +1 CWE-77

TI-2025-38179 CVE-2025-61786 · GHSA-qq26-84mh-26j9

Deno's --deny-read check does not prevent permission bypass

LOW 15

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.002 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 CWE-269

TI-2025-38178 CVE-2025-61785 · GHSA-vg2r-rmgp-cgqj

Deno's --deny-write check does not prevent permission bypass

MEDIUM 49

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00204 Published 2025-10-08 Fixed in 2.5.3, 2.2.15 CWE-266

TI-2025-31073 CVE-2025-48935 · GHSA-8vxj-4cph-c596

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

MEDIUM 58

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00488 Published 2025-06-04 Fixed in 2.2.5, 0.134.0 CWE-863

TI-2025-31072 CVE-2025-48934 · GHSA-7w8p-chxq-2789

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00444 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +1 CWE-201

TI-2025-31038 CVE-2025-48888 · GHSA-xqxc-x6p3-w683

Deno run with --allow-read and --deny-read flags results in allowed

MEDIUM 64

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00423 Published 2025-06-04 Fixed in 2.1.13, 2.2.13 +2 CWE-863

TI-2025-17782 CVE-2025-24015 · GHSA-2x3r-hwv5-p32x

Deno's AES GCM authentication tags are not verified

HIGH 73

Deno is a JavaScript, TypeScript, and WebAssembly runtime.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00287 Published 2025-06-03 Fixed in 2.1.7, 0.125.0 CWE-347

TI-2024-24677 CVE-2024-37150

Private npm registry support used scope auth token for downloading tarballs

LOW 34

An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.0042 Published 2024-06-06 No fix listed CWE-200

TI-2024-22687 CVE-2024-34346 · GHSA-23rx-c3g5-hv9w

Deno contains a permission escalation via open of privileged files with missing `--deny` flag

MEDIUM 41

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1CRITICAL 9.0 Adjacent network Low privileges No interaction EPSS 0.00368 Published 2024-05-07 Fixed in 1.43.0, 1.43.1 CWE-863

TI-2024-21371 CVE-2024-32477

Race condition when flushing input stream leads to permission prompt bypass

HIGH 67

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.0034 Published 2024-04-18 Fixed in 1.42.2 CWE-362

TI-2024-18539 CVE-2024-27936 · GHSA-m4pq-fv2w-6hrw

Deno interactive permission prompt spoofing via improper ANSI stripping

HIGH 71

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00943 Published 2024-03-06 Fixed in 1.41.0, 0.147.0 CWE-150

Vulnerabilities

Filters