denoland vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20234
4. 202411
5. 20259
6. 202615

Newest CVEs

• CVE-2026-103473

  Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

  denoland · deno

  Critical9.2
• CVE-2026-55517

  Deno: Denial of service via non-ASCII bytes in WebSocket response headers

  denoland · deno

  Medium4.3
• CVE-2026-44726

  Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

  denoland · deno

  High7.4
• CVE-2026-49401

  Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

  denoland · deno

  High7.3
• CVE-2026-49402

  Deno: Command Injection via spawnSync & spawn on Windows

  denoland · deno

  High8.1
• CVE-2026-49406

  Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

  denoland · deno

  Medium5.5
• CVE-2026-49411

  Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

  denoland · deno

  Medium6.5
• CVE-2026-49983

  Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

  denoland · deno

  Medium5.2
• CVE-2026-49860

  Deno: WebSocket API sandbox bypass via missing post-DNS check

  denoland · deno

  Medium5.2
• CVE-2026-49859

  Deno: `fetch()` API sandbox bypass via missing DNS resolution check

  denoland · deno

  Medium5.2