# deno (crates.io) vulnerabilities 37 known vulnerabilities (4 critical, 18 high, 12 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.9.8 (Oct 21, 2026): no advisory affects it - Newest unaffected release: 2.9.8 (Oct 21, 2026), the latest release - Weekly downloads: 227 - Dependents: 0 - Releases: 349 since 0.0.1 (Sep 12, 2018) - Registry: https://crates.io/crates/deno - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55517: 0.0.1 to 2.7.4 (2.7.5 is outside it) - CVE-2026-44726: 2.0.0 to 2.7.7 (2.7.8 is outside it) - CVE-2026-49401: 0.0.1 to 2.7.13 (2.7.14 is outside it) - CVE-2026-49402: 0.0.1 to 2.7.9 (2.7.10 is outside it) - CVE-2026-49406: 0.0.1 to 2.7.11 (2.7.12 is outside it) - CVE-2026-49411: 0.0.1 to 2.7.14 (2.8.0 is outside it) - CVE-2026-49983: 0.0.1 to 2.8.0 (2.8.1 is outside it) - CVE-2026-49860: 0.0.1 to 2.8.0 (2.8.1 is outside it) - CVE-2026-49859: 0.0.1 to 2.8.0 (2.8.1 is outside it) - CVE-2026-49440: 0.0.1 to 2.8.0 (2.8.1 is outside it) - CVE-2026-32260: 2.7.0 to 2.7.1 (2.7.2 is outside it) - CVE-2026-27190: 0.0.1 to 2.6.7 (2.6.8 is outside it) - CVE-2026-22864: 0.0.1 to 2.5.5 (2.5.6 is outside it) - CVE-2026-22863: 0.0.1 to 2.5.6 (2.6.0 is outside it) - CVE-2025-61787: 0.0.1 to 2.5.1 (2.5.2 is outside it) - CVE-2025-61786: 0.0.1 to 2.5.2 (2.5.3 is outside it) - CVE-2025-61785: 0.0.1 to 2.5.2 (2.5.3 is outside it) - CVE-2025-48935: 2.2.0 to 2.2.4 (2.2.5 is outside it) - CVE-2025-48934: 0.0.1 to 2.2.12 (2.3.0 is outside it) - CVE-2025-48888: 1.41.3 to 2.3.1 (2.3.2 is outside it) - CVE-2025-24015: 1.46.0 to 2.1.6 (2.1.7 is outside it) - CVE-2025-21620: 0.0.1 to 1.46.3 (2.0.0-rc.9 is outside it); 2.0.0 to 2.1.1 (2.1.2 is outside it) - CVE-2024-34346: 0.0.1 to 1.43.0 (1.43.1 is outside it) - CVE-2024-27936: 1.32.1 to 1.40.5 (1.41.0 is outside it) - CVE-2024-27935: 1.35.1 to 1.36.2 (1.36.3 is outside it) - CVE-2024-27934: 1.36.2 to 1.40.2 (1.40.3 is outside it) - CVE-2024-27933: 1.39.0 (1.39.1 is outside it) - CVE-2024-27932: 1.8.0 to 1.40.3 (1.40.4 is outside it) - CVE-2024-27931: 0.0.1 to 1.41.0 (1.41.1 is outside it) - CVE-2023-33966: 1.34.0 (1.34.1 is outside it) - CVE-2023-28446: 1.8.0 to 1.31.1 (1.31.2 is outside it) - CVE-2023-28445: 1.32.0 (1.32.1 is outside it) - CVE-2023-26103: 1.12.0 to 1.30.3 (1.31.0 is outside it) - CVE-2023-22499: 1.9.0 to 1.29.2 (1.29.3 is outside it) - CVE-2021-41641: 0.0.1 to 1.15.3 (1.16.0 is outside it) - CVE-2022-24783: 1.18.0 to 1.20.2 (1.20.3 is outside it) - CVE-2021-32619: 1.5.0 to 1.10.1 (1.10.2 is outside it) ## Advisories (37) ### [CVE-2026-55517](https://cve.now/CVE-2026-55517): Deno: Denial of service via non-ASCII bytes in WebSocket response headers - Severity: Medium 4.3 - Published: Jun 23, 2026 - Affected: fixed in 2.7.5. - Fixed in 2.7.5 (released Mar 11, 2026, 104 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-44726](https://cve.now/CVE-2026-44726): Deno: TLS retry copies stale upgrade hook, risking plaintext traffic - Severity: High 7.4 - Published: Jun 23, 2026 - Affected: from 2.0.0, fixed in 2.7.8. - Fixed in 2.7.8 (released Mar 25, 2026, 90 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49401](https://cve.now/CVE-2026-49401): Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) - Severity: High 7.3 - Published: Jun 23, 2026 - Affected: fixed in 2.7.14. - Fixed in 2.7.14 (released Apr 28, 2026, 56 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49402](https://cve.now/CVE-2026-49402): Deno: Command Injection via spawnSync & spawn on Windows - Severity: High 8.1 - Published: Jun 23, 2026 - Affected: fixed in 2.7.10. - Fixed in 2.7.10 (released Mar 31, 2026, 84 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49406](https://cve.now/CVE-2026-49406): Deno: BYONM module resolution allows \`package.json\` main path traversal to bypass \`--allow-read\` restrictions - Severity: Medium 5.5 - Published: Jun 23, 2026 - Affected: fixed in 2.7.12. - Fixed in 2.7.12 (released Apr 9, 2026, 75 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49411](https://cve.now/CVE-2026-49411): Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks - Severity: Medium 6.5 - Published: Jun 23, 2026 - Affected: fixed in 2.8.0. - Fixed in 2.8.0 (released May 22, 2026, 32 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49983](https://cve.now/CVE-2026-49983): Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access - Severity: Medium 5.2 - Published: Jun 23, 2026 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49860](https://cve.now/CVE-2026-49860): Deno: WebSocket API sandbox bypass via missing post-DNS check - Severity: Medium 5.2 - Published: Jun 23, 2026 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49859](https://cve.now/CVE-2026-49859): Deno: \`fetch()\` API sandbox bypass via missing DNS resolution check - Severity: Medium 5.2 - Published: Jun 23, 2026 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-49440](https://cve.now/CVE-2026-49440): Deno: Miller-Rabin Primality Test Allows Zero Rounds - Severity: High 7.4 - Published: Jun 23, 2026 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released May 27, 2026, 27 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-32260](https://cve.now/CVE-2026-32260): Command Injection via incomplete shell metacharacter blocklist in node:child\_process (bypass of CVE-2026-27190 fix) - Severity: High 8.1 - Published: Mar 12, 2026 - Affected: from 2.7.0, fixed in 2.7.2. - Fixed in 2.7.2 (released Mar 3, 2026, 9 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-27190](https://cve.now/CVE-2026-27190): Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child\_process - Severity: High 8.1 - Published: Feb 20, 2026 - Affected: fixed in 2.6.8. - Fixed in 2.6.8 (released Feb 2, 2026, 18 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-22864](https://cve.now/CVE-2026-22864): Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass - Severity: High 8.1 - Published: Jan 15, 2026 - Affected: fixed in 2.5.6. - Fixed in 2.5.6 (released Oct 30, 2025, 77 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2026-22863](https://cve.now/CVE-2026-22863): Deno node:crypto doesn't finalize cipher - Severity: Critical 9.2 - Published: Jan 15, 2026 - Affected: fixed in 2.6.0. - Fixed in 2.6.0 (released Dec 10, 2025, 36 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-61787](https://cve.now/CVE-2025-61787): Deno is Vulnerable to Command Injection on Windows During Batch File Execution - Severity: High 8.1 - Published: Oct 8, 2025 - Affected: fixed in 2.5.2. - Fixed in 2.5.2 (released Sep 24, 2025, 14 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-61786](https://cve.now/CVE-2025-61786): Deno's --deny-read check does not prevent permission bypass - Severity: Low 3.3 - Published: Oct 8, 2025 - Affected: fixed in 2.5.3. - Fixed in 2.5.3 (released Oct 3, 2025, 5 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-61785](https://cve.now/CVE-2025-61785): Deno's --deny-write check does not prevent permission bypass - Severity: Low 3.3 - Published: Oct 8, 2025 - Affected: fixed in 2.5.3. - Fixed in 2.5.3 (released Oct 3, 2025, 5 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-48935](https://cve.now/CVE-2025-48935): Deno has --allow-read / --allow-write permission bypass in \`node:sqlite\` - Severity: Medium 5.5 - Published: Jun 4, 2025 - Affected: from 2.2.0, fixed in 2.2.5. - Fixed in 2.2.5 (released Mar 21, 2025, 75 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-48934](https://cve.now/CVE-2025-48934): Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables - Severity: Medium 5.5 - Published: Jun 4, 2025 - Affected: fixed in 2.1.13; from 2.2.0, fixed in 2.2.13. - Fixed in 2.3.0 (released Apr 30, 2025, 35 days before disclosure, the advisory names 2.1.13, which was never published). - The latest release, 2.9.8, is not affected. ### [CVE-2025-48888](https://cve.now/CVE-2025-48888): Deno run with --allow-read and --deny-read flags results in allowed - Severity: Medium 5.5 - Published: Jun 4, 2025 - Affected: from 1.41.3, fixed in 2.1.13; from 2.2.0, fixed in 2.2.13; from 2.3.0, fixed in 2.3.2. - Fixed in 2.3.2 (released May 15, 2025, 20 days before disclosure, the advisory names 2.1.13, which was never published). - The latest release, 2.9.8, is not affected. ### [CVE-2025-24015](https://cve.now/CVE-2025-24015): Deno's AES GCM authentication tags are not verified - Severity: High 7.7 - Published: Jun 3, 2025 - Affected: from 1.46.0, fixed in 2.1.7. - Fixed in 2.1.7 (released Jan 22, 2025, 132 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2025-21620](https://cve.now/CVE-2025-21620): Deno's authorization headers not dropped when redirecting cross-origin - Severity: High 7.5 - Published: Jan 6, 2025 - Affected: through 1.46.3; from 2.0.0, fixed in 2.1.2. - Fixed in 2.1.2 (released Nov 28, 2024, 39 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-34346](https://cve.now/CVE-2024-34346): Deno contains a permission escalation via open of privileged files with missing \`--deny\` flag - Severity: High 8.5 - Published: May 7, 2024 - Affected: fixed in 1.43.1. - Fixed in 1.43.1 (released May 1, 2024, 6 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27936](https://cve.now/CVE-2024-27936): Deno interactive permission prompt spoofing via improper ANSI stripping - Severity: High 8.8 - Published: Mar 6, 2024 - Affected: from 1.32.1, fixed in 1.41.0. - Fixed in 1.41.0 (released Feb 22, 2024, 13 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27935](https://cve.now/CVE-2024-27935): Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination - Severity: High 7.2 - Published: Mar 6, 2024 - Affected: from 1.35.1, fixed in 1.36.3. - Fixed in 1.36.3 (released Aug 24, 2023, 195 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27934](https://cve.now/CVE-2024-27934): \*const c\_void / ExternalPointer unsoundness leading to use-after-free - Severity: High 8.4 - Published: Mar 6, 2024 - Affected: from 1.36.2, fixed in 1.40.3. - Fixed in 1.40.3 (released Feb 1, 2024, 34 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27933](https://cve.now/CVE-2024-27933): Deno arbitrary file descriptor close via \`op\_node\_ipc\_pipe()\` leading to permission prompt bypass - Severity: High 8.3 - Published: Mar 6, 2024 - Affected: from 1.39.0, fixed in 1.39.1. - Fixed in 1.39.1 (released Dec 21, 2023, 76 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27932](https://cve.now/CVE-2024-27932): Deno's improper suffix match testing for DENO\_AUTH\_TOKENS - Severity: Medium 4.6 - Published: Mar 6, 2024 - Affected: from 1.8.0, fixed in 1.40.4. - Fixed in 1.40.4 (released Feb 8, 2024, 27 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2024-27931](https://cve.now/CVE-2024-27931): Insufficient permission checking in \`Deno.makeTemp\*\` APIs - Severity: Medium 5.8 - Published: Mar 5, 2024 - Affected: fixed in 1.41.1. - Fixed in 1.41.1 (released Mar 1, 2024, 4 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2023-33966](https://cve.now/CVE-2023-33966): Deno missing "--allow-net" permission check for built-in Node modules - Severity: High 8.6 - Published: May 31, 2023 - Affected: from 1.34.0, fixed in 1.34.1. - Fixed in 1.34.1 (released May 30, 2023, 1 day before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2023-28446](https://cve.now/CVE-2023-28446): Deno is vulnerable to interactive \`run\` permission prompt spoofing via improper ANSI neutralization - Severity: High 8.8 - Published: Mar 24, 2023 - Affected: from 1.8.0, fixed in 1.31.2. - Fixed in 1.31.2 (released Mar 10, 2023, 14 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2023-28445](https://cve.now/CVE-2023-28445): Deno improperly handles resizable ArrayBuffer - Severity: Critical 10.0 - Published: Mar 23, 2023 - Affected: from 1.32.0, fixed in 1.32.1. - Fixed in 1.32.1 (released Mar 23, 2023, the day of disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2023-26103](https://cve.now/CVE-2023-26103): Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket… - Severity: Medium 5.3 - Published: Feb 25, 2023 - Affected: from 1.12.0, fixed in 1.31.0. - Fixed in 1.31.0 (released Feb 24, 2023, 1 day before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2023-22499](https://cve.now/CVE-2023-22499): Interactive permission prompt spoofing in Deno - Severity: High 7.5 - Published: Jan 17, 2023 - Affected: from 1.9.0, fixed in 1.29.3. - Fixed in 1.29.3 (released Jan 13, 2023, 4 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2021-41641](https://cve.now/CVE-2021-41641): Deno \<=1.14.0 file sandbox does not handle symbolic links correctly. - Severity: Unrated - Published: Jun 12, 2022 - Affected: fixed in 1.16.0. - Fixed in 1.16.0 (released Nov 9, 2021, 215 days before disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2022-24783](https://cve.now/CVE-2022-24783): Sandbox bypass leading to arbitrary code execution in Deno - Severity: Critical 10.0 - Published: Mar 25, 2022 - Affected: from 1.18.0, fixed in 1.20.3. - Fixed in 1.20.3 (released Mar 25, 2022, the day of disclosure). - The latest release, 2.9.8, is not affected. ### [CVE-2021-32619](https://cve.now/CVE-2021-32619): Static imports inside dynamically imported modules do not adhere to permission checks - Severity: Critical 9.8 - Published: May 28, 2021 - Affected: from 1.5.0, fixed in 1.10.2. - Fixed in 1.10.2 (released May 17, 2021, 11 days before disclosure). - The latest release, 2.9.8, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/deno Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.