- Latest release
- 2.9.8 (Oct 21, 2026): no advisory affects it
- Newest unaffected release
- 2.9.8 (Oct 21, 2026), the latest release
- Advisories
- 37 · 4 critical, 18 high, 12 medium, 2 low
- Weekly downloads
- 227
- Dependents
- 0
- Releases
- 349 since 0.0.1 (Sep 12, 2018)
- Registry
- crates.io
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-55517Affects 0.0.1 to 2.7.4 (2.7.5 is outside it)
- CVE-2026-44726Affects 2.0.0 to 2.7.7 (2.7.8 is outside it)
- CVE-2026-49401Affects 0.0.1 to 2.7.13 (2.7.14 is outside it)
- CVE-2026-49402Affects 0.0.1 to 2.7.9 (2.7.10 is outside it)
- CVE-2026-49406Affects 0.0.1 to 2.7.11 (2.7.12 is outside it)
- CVE-2026-49411Affects 0.0.1 to 2.7.14 (2.8.0 is outside it)
- CVE-2026-49983Affects 0.0.1 to 2.8.0 (2.8.1 is outside it)
- CVE-2026-49860Affects 0.0.1 to 2.8.0 (2.8.1 is outside it)
- CVE-2026-49859Affects 0.0.1 to 2.8.0 (2.8.1 is outside it)
- CVE-2026-49440Affects 0.0.1 to 2.8.0 (2.8.1 is outside it)
- CVE-2026-32260Affects 2.7.0 to 2.7.1 (2.7.2 is outside it)
- CVE-2026-27190Affects 0.0.1 to 2.6.7 (2.6.8 is outside it)
Show all 37 advisoriesShow fewer advisories
- CVE-2026-22864Affects 0.0.1 to 2.5.5 (2.5.6 is outside it)
- CVE-2026-22863Affects 0.0.1 to 2.5.6 (2.6.0 is outside it)
- CVE-2025-61787Affects 0.0.1 to 2.5.1 (2.5.2 is outside it)
- CVE-2025-61786Affects 0.0.1 to 2.5.2 (2.5.3 is outside it)
- CVE-2025-61785Affects 0.0.1 to 2.5.2 (2.5.3 is outside it)
- CVE-2025-48935Affects 2.2.0 to 2.2.4 (2.2.5 is outside it)
- CVE-2025-48934Affects 0.0.1 to 2.2.12 (2.3.0 is outside it)
- CVE-2025-48888Affects 1.41.3 to 2.3.1 (2.3.2 is outside it)
- CVE-2025-24015Affects 1.46.0 to 2.1.6 (2.1.7 is outside it)
- CVE-2025-21620Affects 0.0.1 to 1.46.3 (2.0.0-rc.9 is outside it); 2.0.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2024-34346Affects 0.0.1 to 1.43.0 (1.43.1 is outside it)
- CVE-2024-27936Affects 1.32.1 to 1.40.5 (1.41.0 is outside it)
- CVE-2024-27935Affects 1.35.1 to 1.36.2 (1.36.3 is outside it)
- CVE-2024-27934Affects 1.36.2 to 1.40.2 (1.40.3 is outside it)
- CVE-2024-27933Affects 1.39.0 (1.39.1 is outside it)
- CVE-2024-27932Affects 1.8.0 to 1.40.3 (1.40.4 is outside it)
- CVE-2024-27931Affects 0.0.1 to 1.41.0 (1.41.1 is outside it)
- CVE-2023-33966Affects 1.34.0 (1.34.1 is outside it)
- CVE-2023-28446Affects 1.8.0 to 1.31.1 (1.31.2 is outside it)
- CVE-2023-28445Affects 1.32.0 (1.32.1 is outside it)
- CVE-2023-26103Affects 1.12.0 to 1.30.3 (1.31.0 is outside it)
- CVE-2023-22499Affects 1.9.0 to 1.29.2 (1.29.3 is outside it)
- CVE-2021-41641Affects 0.0.1 to 1.15.3 (1.16.0 is outside it)
- CVE-2022-24783Affects 1.18.0 to 1.20.2 (1.20.3 is outside it)
- CVE-2021-32619Affects 1.5.0 to 1.10.1 (1.10.2 is outside it)
Advisories 37
- CVE-2026-55517Medium 4.3
Deno: Denial of service via non-ASCII bytes in WebSocket response headers
Affected: fixed in 2.7.5.
Fixed in 2.7.5 (released Mar 11, 2026, 104 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-44726High 7.4
Deno: TLS retry copies stale upgrade hook, risking plaintext traffic
Affected: from 2.0.0, fixed in 2.7.8.
Fixed in 2.7.8 (released Mar 25, 2026, 90 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49401High 7.3
Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
Affected: fixed in 2.7.14.
Fixed in 2.7.14 (released Apr 28, 2026, 56 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49402High 8.1
Deno: Command Injection via spawnSync & spawn on Windows
Affected: fixed in 2.7.10.
Fixed in 2.7.10 (released Mar 31, 2026, 84 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49406Medium 5.5
Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
Affected: fixed in 2.7.12.
Fixed in 2.7.12 (released Apr 9, 2026, 75 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49411Medium 6.5
Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
Affected: fixed in 2.8.0.
Fixed in 2.8.0 (released May 22, 2026, 32 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49983Medium 5.2
Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
Affected: fixed in 2.8.1.
Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49860Medium 5.2
Deno: WebSocket API sandbox bypass via missing post-DNS check
Affected: fixed in 2.8.1.
Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49859Medium 5.2
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
Affected: fixed in 2.8.1.
Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-49440High 7.4
Deno: Miller-Rabin Primality Test Allows Zero Rounds
Affected: fixed in 2.8.1.
Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-32260High 8.1
Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
Affected: from 2.7.0, fixed in 2.7.2.
Fixed in 2.7.2 (released Mar 3, 2026, 9 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-27190High 8.1
Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
Affected: fixed in 2.6.8.
Fixed in 2.6.8 (released Feb 2, 2026, 18 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-22864High 8.1
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
Affected: fixed in 2.5.6.
Fixed in 2.5.6 (released Oct 30, 2025, 77 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2026-22863Critical 9.2
Deno node:crypto doesn't finalize cipher
Affected: fixed in 2.6.0.
Fixed in 2.6.0 (released Dec 10, 2025, 36 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2025-61787High 8.1
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
Affected: fixed in 2.5.2.
Fixed in 2.5.2 (released Sep 24, 2025, 14 days before disclosure).
The latest release, 2.9.8, is not affected.
Show all 37 advisoriesShow fewer advisories
- CVE-2025-61786Low 3.3
Deno's --deny-read check does not prevent permission bypass
Affected: fixed in 2.5.3.
Fixed in 2.5.3 (released Oct 3, 2025, 5 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2025-61785Low 3.3
Deno's --deny-write check does not prevent permission bypass
Affected: fixed in 2.5.3.
Fixed in 2.5.3 (released Oct 3, 2025, 5 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2025-48935Medium 5.5
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
Affected: from 2.2.0, fixed in 2.2.5.
Fixed in 2.2.5 (released Mar 21, 2025, 75 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2025-48934Medium 5.5
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
Affected: fixed in 2.1.13; from 2.2.0, fixed in 2.2.13.
Fixed in 2.3.0 (released Apr 30, 2025, 35 days before disclosure, the advisory names 2.1.13, which was never published).
The latest release, 2.9.8, is not affected.
- CVE-2025-48888Medium 5.5
Deno run with --allow-read and --deny-read flags results in allowed
Affected: from 1.41.3, fixed in 2.1.13; from 2.2.0, fixed in 2.2.13; from 2.3.0, fixed in 2.3.2.
Fixed in 2.3.2 (released May 15, 2025, 20 days before disclosure, the advisory names 2.1.13, which was never published).
The latest release, 2.9.8, is not affected.
- CVE-2025-24015High 7.7
Deno's AES GCM authentication tags are not verified
Affected: from 1.46.0, fixed in 2.1.7.
Fixed in 2.1.7 (released Jan 22, 2025, 132 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2025-21620High 7.5
Deno's authorization headers not dropped when redirecting cross-origin
Affected: through 1.46.3; from 2.0.0, fixed in 2.1.2.
Fixed in 2.1.2 (released Nov 28, 2024, 39 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-34346High 8.5
Deno contains a permission escalation via open of privileged files with missing `--deny` flag
Affected: fixed in 1.43.1.
Fixed in 1.43.1 (released May 1, 2024, 6 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27936High 8.8
Deno interactive permission prompt spoofing via improper ANSI stripping
Affected: from 1.32.1, fixed in 1.41.0.
Fixed in 1.41.0 (released Feb 22, 2024, 13 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27935High 7.2
Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
Affected: from 1.35.1, fixed in 1.36.3.
Fixed in 1.36.3 (released Aug 24, 2023, 195 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27934High 8.4
*const c_void / ExternalPointer unsoundness leading to use-after-free
Affected: from 1.36.2, fixed in 1.40.3.
Fixed in 1.40.3 (released Feb 1, 2024, 34 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27933High 8.3
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
Affected: from 1.39.0, fixed in 1.39.1.
Fixed in 1.39.1 (released Dec 21, 2023, 76 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27932Medium 4.6
Deno's improper suffix match testing for DENO_AUTH_TOKENS
Affected: from 1.8.0, fixed in 1.40.4.
Fixed in 1.40.4 (released Feb 8, 2024, 27 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2024-27931Medium 5.8
Insufficient permission checking in `Deno.makeTemp*` APIs
Affected: fixed in 1.41.1.
Fixed in 1.41.1 (released Mar 1, 2024, 4 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2023-33966High 8.6
Deno missing "--allow-net" permission check for built-in Node modules
Affected: from 1.34.0, fixed in 1.34.1.
Fixed in 1.34.1 (released May 30, 2023, 1 day before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2023-28446High 8.8
Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
Affected: from 1.8.0, fixed in 1.31.2.
Fixed in 1.31.2 (released Mar 10, 2023, 14 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2023-28445Critical 10.0
Deno improperly handles resizable ArrayBuffer
Affected: from 1.32.0, fixed in 1.32.1.
Fixed in 1.32.1 (released Mar 23, 2023, the day of disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2023-26103Medium 5.3
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket…
Affected: from 1.12.0, fixed in 1.31.0.
Fixed in 1.31.0 (released Feb 24, 2023, 1 day before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2023-22499High 7.5
Interactive permission prompt spoofing in Deno
Affected: from 1.9.0, fixed in 1.29.3.
Fixed in 1.29.3 (released Jan 13, 2023, 4 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2021-41641Unrated
Deno <=1.14.0 file sandbox does not handle symbolic links correctly.
Affected: fixed in 1.16.0.
Fixed in 1.16.0 (released Nov 9, 2021, 215 days before disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2022-24783Critical 10.0
Sandbox bypass leading to arbitrary code execution in Deno
Affected: from 1.18.0, fixed in 1.20.3.
Fixed in 1.20.3 (released Mar 25, 2022, the day of disclosure).
The latest release, 2.9.8, is not affected.
- CVE-2021-32619Critical 9.8
Static imports inside dynamically imported modules do not adhere to permission checks
Affected: from 1.5.0, fixed in 1.10.2.
Fixed in 1.10.2 (released May 17, 2021, 11 days before disclosure).
The latest release, 2.9.8, is not affected.