# cve.now: Denoland

The newest entries naming Denoland as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103473](https://cve.now/CVE-2026-103473.md): Deno 2.7.0 through 2.9.7 Command Injection via node:child\_process (CVSS 9.2)
- [CVE-2026-55517](https://cve.now/CVE-2026-55517.md): Deno: Denial of service via non-ASCII bytes in WebSocket response headers (CVSS 4.3)
- [CVE-2026-44726](https://cve.now/CVE-2026-44726.md): Deno: TLS retry copies stale upgrade hook, risking plaintext traffic (CVSS 7.4)
- [CVE-2026-49401](https://cve.now/CVE-2026-49401.md): Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) (CVSS 7.3)
- [CVE-2026-49402](https://cve.now/CVE-2026-49402.md): Deno: Command Injection via spawnSync & spawn on Windows (CVSS 8.1)
- [CVE-2026-49406](https://cve.now/CVE-2026-49406.md): Deno: BYONM module resolution allows \`package.json\` main path traversal to bypass \`--allow-read\` restrictions (CVSS 5.5)
- [CVE-2026-49411](https://cve.now/CVE-2026-49411.md): Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks (CVSS 6.5)
- [CVE-2026-49983](https://cve.now/CVE-2026-49983.md): Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access (CVSS 5.2)
- [CVE-2026-49860](https://cve.now/CVE-2026-49860.md): Deno: WebSocket API sandbox bypass via missing post-DNS check (CVSS 5.2)
- [CVE-2026-49859](https://cve.now/CVE-2026-49859.md): Deno: \`fetch()\` API sandbox bypass via missing DNS resolution check (CVSS 5.2)
- [CVE-2026-49440](https://cve.now/CVE-2026-49440.md): Deno: Miller-Rabin Primality Test Allows Zero Rounds (CVSS 7.4)
- [CVE-2026-32260](https://cve.now/CVE-2026-32260.md): Command Injection via incomplete shell metacharacter blocklist in node:child\_process (bypass of CVE-2026-27190 fix) (CVSS 8.1)
- [CVE-2026-27190](https://cve.now/CVE-2026-27190.md): Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child\_process (CVSS 8.1)
- [CVE-2026-22864](https://cve.now/CVE-2026-22864.md): Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass (CVSS 8.1)
- [CVE-2026-22863](https://cve.now/CVE-2026-22863.md): Deno node:crypto doesn't finalize cipher (CVSS 9.2)
- [CVE-2025-61787](https://cve.now/CVE-2025-61787.md): Deno is Vulnerable to Command Injection on Windows During Batch File Execution (CVSS 8.1)
- [CVE-2025-61786](https://cve.now/CVE-2025-61786.md): Deno's --deny-read check does not prevent permission bypass (CVSS 3.3)
- [CVE-2025-61785](https://cve.now/CVE-2025-61785.md): Deno's --deny-write check does not prevent permission bypass (CVSS 3.3)
- [CVE-2025-55195](https://cve.now/CVE-2025-55195.md): @std/toml Prototype Pollution in Node.js and Browser (CVSS 7.3)
- [CVE-2025-48935](https://cve.now/CVE-2025-48935.md): Deno has --allow-read / --allow-write permission bypass in \`node:sqlite\` (CVSS 5.5)
- [CVE-2025-48934](https://cve.now/CVE-2025-48934.md): Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables (CVSS 5.5)
- [CVE-2025-48888](https://cve.now/CVE-2025-48888.md): Deno run with --allow-read and --deny-read flags results in allowed (CVSS 5.5)
- [CVE-2025-24015](https://cve.now/CVE-2025-24015.md): Deno's AES GCM authentication tags are not verified (CVSS 7.7)
- [CVE-2025-21620](https://cve.now/CVE-2025-21620.md): Deno's authorization headers not dropped when redirecting cross-origin (CVSS 7.5)
- [CVE-2024-32468](https://cve.now/CVE-2024-32468.md): Improper neutralization of input during web page generation ("Cross-site Scripting") in deno\_doc HTML generator (CVSS 5.4)
- [CVE-2024-52793](https://cve.now/CVE-2024-52793.md): XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems (CVSS 5.1)
- [CVE-2024-37150](https://cve.now/CVE-2024-37150.md): Private npm registry support used scope auth token for downloading tarballs (CVSS 7.6)
- [CVE-2024-34346](https://cve.now/CVE-2024-34346.md): Deno contains a permission escalation via open of privileged files with missing \`--deny\` flag (CVSS 8.5)
- [CVE-2024-32477](https://cve.now/CVE-2024-32477.md): Race condition when flushing input stream leads to permission prompt bypass (CVSS 7.7)
- [CVE-2024-27936](https://cve.now/CVE-2024-27936.md): Deno interactive permission prompt spoofing via improper ANSI stripping (CVSS 8.8)
- [CVE-2024-27935](https://cve.now/CVE-2024-27935.md): Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination (CVSS 7.2)
- [CVE-2024-27934](https://cve.now/CVE-2024-27934.md): \*const c\_void / ExternalPointer unsoundness leading to use-after-free (CVSS 8.4)
- [CVE-2024-27933](https://cve.now/CVE-2024-27933.md): Deno arbitrary file descriptor close via \`op\_node\_ipc\_pipe()\` leading to permission prompt bypass (CVSS 8.3)
- [CVE-2024-27932](https://cve.now/CVE-2024-27932.md): Deno's improper suffix match testing for DENO\_AUTH\_TOKENS (CVSS 4.6)
- [CVE-2024-27931](https://cve.now/CVE-2024-27931.md): Insufficient permission checking in \`Deno.makeTemp\*\` APIs (CVSS 5.8)
- [CVE-2023-33966](https://cve.now/CVE-2023-33966.md): Deno missing "--allow-net" permission check for built-in Node modules (CVSS 8.6)
- [CVE-2023-28446](https://cve.now/CVE-2023-28446.md): Deno is vulnerable to interactive \`run\` permission prompt spoofing via improper ANSI neutralization (CVSS 8.8)
- [CVE-2023-28445](https://cve.now/CVE-2023-28445.md): Deno improperly handles resizable ArrayBuffer (CVSS 10.0)
- [CVE-2023-22499](https://cve.now/CVE-2023-22499.md): Interactive permission prompt spoofing in Deno (CVSS 7.5)
- [CVE-2022-24783](https://cve.now/CVE-2022-24783.md): Sandbox bypass leading to arbitrary code execution in Deno (CVSS 10.0)
- [CVE-2021-32619](https://cve.now/CVE-2021-32619.md): Static imports inside dynamically imported modules do not adhere to permission checks (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/denoland
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.