Denoland Deno vulnerabilities

• denoland deno Deno 2.7.0 through 2.9.7 Command Injection via node:child_process CVE-2026-103473 9.2 CriticalSeptember 30, 2026
• deno Deno: Denial of service via non-ASCII bytes in WebSocket response headers CVE-2026-55517 Fix available 4.3 MediumJune 17, 2026
• deno Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) CVE-2026-49401 Fix available 7.3 HighJune 16, 2026
• deno Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions CVE-2026-49406 Fix available 5.5 MediumJune 16, 2026
• deno Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks CVE-2026-49411 Fix available 6.5 MediumJune 16, 2026
• deno Deno: Miller-Rabin Primality Test Allows Zero Rounds CVE-2026-49440 Fix available 7.4 HighJune 16, 2026
• deno Deno: Command Injection via spawnSync & spawn on Windows CVE-2026-49402 Fix available 8.1 HighJune 16, 2026
• deno Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access CVE-2026-49983 Fix available 5.2 MediumJune 16, 2026
• deno Deno: WebSocket API sandbox bypass via missing post-DNS check CVE-2026-49860 Fix available 5.2 MediumJune 16, 2026
• deno Deno: `fetch()` API sandbox bypass via missing DNS resolution check CVE-2026-49859 Fix available 5.2 MediumJune 16, 2026
• deno Deno: TLS retry copies stale upgrade hook, risking plaintext traffic CVE-2026-44726 Fix available 7.4 HighMay 27, 2026
• deno Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix) CVE-2026-32260 Fix available 8.1 HighMarch 12, 2026
• deno Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVE-2026-27190 Fix available 8.1 HighFebruary 19, 2026
• deno Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass CVE-2026-22864 Fix available 8.1 HighJanuary 15, 2026
• deno Deno node:crypto doesn't finalize cipher CVE-2026-22863 Fix available 9.2 CriticalJanuary 15, 2026
• deno Deno is Vulnerable to Command Injection on Windows During Batch File Execution CVE-2025-61787 Fix available 8.1 HighOctober 8, 2025
• deno Deno's --deny-read check does not prevent permission bypass CVE-2025-61786 Fix available 3.3 LowOctober 8, 2025
• deno Deno's --deny-write check does not prevent permission bypass CVE-2025-61785 Fix available 3.3 LowOctober 7, 2025
• deno Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables CVE-2025-48934 Fix available 5.5 MediumJune 4, 2025
• deno Deno run with --allow-read and --deny-read flags results in allowed CVE-2025-48888 Fix available 5.5 MediumJune 4, 2025
• deno Deno's AES GCM authentication tags are not verified CVE-2025-24015 Fix available 7.7 HighJune 3, 2025
• deno Deno has --allow-read / --allow-write permission bypass in `node:sqlite` CVE-2025-48935 Fix available 5.5 MediumJune 3, 2025
• denoland deno Deno's authorization headers not dropped when redirecting cross-origin CVE-2025-21620 Fix available 7.5 HighJanuary 6, 2025
• denoland deno Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator CVE-2024-32468 Fix available 5.4 MediumNovember 25, 2024
• deno Private npm registry support used scope auth token for downloading tarballs CVE-2024-37150 7.6 HighJune 6, 2024
• deno Deno contains a permission escalation via open of privileged files with missing `--deny` flag CVE-2024-34346 Fix available 8.5 HighMay 7, 2024
• deno Race condition when flushing input stream leads to permission prompt bypass CVE-2024-32477 Fix available 7.7 HighApril 18, 2024
• deno *const c_void / ExternalPointer unsoundness leading to use-after-free CVE-2024-27934 Fix available 8.4 HighMarch 6, 2024
• deno Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVE-2024-27933 Fix available 8.3 HighMarch 6, 2024
• deno Deno's improper suffix match testing for DENO_AUTH_TOKENS CVE-2024-27932 Fix available 4.6 MediumMarch 6, 2024
• deno, deno runtime +1 more Deno interactive permission prompt spoofing via improper ANSI stripping CVE-2024-27936 Fix available 8.8 HighMarch 5, 2024
• deno Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination CVE-2024-27935 Fix available 7.2 HighMarch 5, 2024
• deno Insufficient permission checking in `Deno.makeTemp*` APIs CVE-2024-27931 Fix available 5.8 MediumMarch 5, 2024
• deno, deno runtime +1 more Deno missing "--allow-net" permission check for built-in Node modules CVE-2023-33966 Fix available 8.6 HighMay 31, 2023
• deno Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVE-2023-28446 Fix available 8.8 HighMarch 24, 2023
• deno, deno runtime, serde v8 +2 more Deno improperly handles resizable ArrayBuffer CVE-2023-28445 Fix available 10.0 CriticalMarch 23, 2023
• deno Regular Expression Denial of Service in Deno.upgradeWebSocket API CVE-2023-26103 Fix available 5.3 MediumFebruary 25, 2023
• deno Interactive permission prompt spoofing in Deno CVE-2023-22499 Fix available 7.5 HighJanuary 17, 2023
• deno Sandbox bypass leading to arbitrary code execution in Deno CVE-2022-24783 Fix available 10.0 CriticalMarch 25, 2022
• deno Static imports inside dynamically imported modules do not adhere to permission checks CVE-2021-32619 Fix available 9.8 CriticalMay 28, 2021