CVE-2026-49411 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.
A vulnerability in Deno's Node.js compatibility TCP path prior to version 2.8.0 allows bypassing network permission rules. The issue arises because the permission check is performed on the original hostname string before resolution, and not re-checked afterward. This flaw enables a caller to use numeric aliases of IP addresses, such as those resolving to 127.0.0.1, to reach denied destinations through certain Node.js networking functions. The vulnerability is present in Deno versions prior to 2.8.0.
Users can upgrade to Deno version 2.8.0 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, consider using an allowlist for network permissions, validating untrusted host input to reject numeric aliases, and avoiding the Node options-host path for sensitive HTTP requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-v8fw-85r8-5m23 | CISA-ADP | ExploitMitigationThird Party Advisory |
| https://github.com/denoland/deno/security/advisories/GHSA-v8fw-85r8-5m23 | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | >= 2.7.14, < 2.8.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |