CVE-2026-49860

5.2 Moyenne

Publiée le 23/06/2026 à 20:18 · Modifiée le 29/06/2026 à 16:37 · Analysée par le NVD · Source : security-advisories@github.com

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

Traduire en français

Produits concernés

denoland deno
Deno deno

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.2 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories