CVE-2026-49860 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.
A vulnerability in Deno's WebSocket handling prior to version 2.8.1 allowed scripts to bypass network restrictions. While Deno checked destination hostnames against deny-net rules, it failed to re-verify the resolved IP addresses. This oversight enabled an attacker-controlled script to use a domain that passed the hostname check but resolved to a denied IP, circumventing network isolation. The issue affects users who run untrusted code with deny-net restrictions and rely on these rules for security.
Users should upgrade to Deno version 2.8.1 or later. If an immediate upgrade is not possible, avoid granting allow-net permissions to untrusted code that also has deny-net restrictions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | < 2.8.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |