CVE-2026-55517 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.
A denial-of-service vulnerability has been identified in Deno, a runtime for JavaScript, TypeScript, and WebAssembly, affecting versions through 2.7.4. The issue arises when a Deno program opens a client WebSocket connection and the remote server sends a response with non-visible ASCII bytes in the Sec-WebSocket-Protocol or Sec-WebSocket-Extensions headers. Deno's handling of these headers assumed all bytes were printable ASCII, leading to a process panic that crashed the application. This vulnerability is particularly concerning for Deno applications connecting to untrusted WebSocket endpoints, as it can be exploited by terminating the process that opened the connection.
Users are advised to upgrade to Deno version 2.7.5 or later, where this vulnerability has been fixed by improving the header parsing to gracefully handle non-ASCII values. Until an upgrade is possible, it is recommended to connect only to trusted WebSocket endpoints and to use wss:// (TLS) instead of ws://, which can be intercepted by a man-in-the-middle.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | < 2.7.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |