Sugarless1101

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.8.0 **Description** The Node.js compatibility TCP path fails to re-verify network permissions after hostname resolution. While the network permission model is intended to apply rules to the resolved IP address, affected versions check permissions against the original hostname string. An attacker can bypass `--deny-net` restrictions by providing a numeric alias of an IP address (such as a decimal integer like `2130706433` or a hexadecimal form like `0x7f000001`) which resolves to a denied destination. This bypass occurs when using the `{ host, port }` options form in the `node:net.connect()` function or the `node:http.request()` function. This allows less-trusted code to reach protected destinations, such as loopback addresses or internal private ranges, that were explicitly denied. **Recommendations** Update to version 2.8.0. As a temporary workaround, prefer using an `--allow-net` allowlist instead of a `--deny-net` denylist. Validate untrusted host input to reject hostnames that are purely decimal integers or begin with `0x` before passing them to `node:net.connect()` or `node:http.request()`. Avoid using the Node options-host path for sensitive calls, opting instead for URL-string forms which are normalized before permission checks.