Denoland vulnerabilities
41 CVEs and advisories name Denoland as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103473Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
- CVE-2026-55517Deno: Denial of service via non-ASCII bytes in WebSocket response headers
- CVE-2026-44726Deno: TLS retry copies stale upgrade hook, risking plaintext traffic
- CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-49402Deno: Command Injection via spawnSync & spawn on Windows
- CVE-2026-49406Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
- CVE-2026-49411Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
- CVE-2026-49983Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
- CVE-2026-49860Deno: WebSocket API sandbox bypass via missing post-DNS check
- CVE-2026-49859Deno: `fetch()` API sandbox bypass via missing DNS resolution check
- CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Rounds
- CVE-2026-32260Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
- CVE-2026-27190Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
- CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
- CVE-2026-22863Deno node:crypto doesn't finalize cipher
- CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Execution
- CVE-2025-61786Deno's --deny-read check does not prevent permission bypass
- CVE-2025-61785Deno's --deny-write check does not prevent permission bypass
- CVE-2025-55195@std/toml Prototype Pollution in Node.js and Browser
- CVE-2025-48935Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
- CVE-2025-48934Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
- CVE-2025-48888Deno run with --allow-read and --deny-read flags results in allowed
- CVE-2025-24015Deno's AES GCM authentication tags are not verified
- CVE-2025-21620Deno's authorization headers not dropped when redirecting cross-origin
- CVE-2024-32468Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator
- CVE-2024-52793XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems
- CVE-2024-37150Private npm registry support used scope auth token for downloading tarballs
- CVE-2024-34346Deno contains a permission escalation via open of privileged files with missing `--deny` flag
- CVE-2024-32477Race condition when flushing input stream leads to permission prompt bypass
- CVE-2024-27936Deno interactive permission prompt spoofing via improper ANSI stripping