PT-2026-50148 · Denoland · Deno
CVSS v3.1
6.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Deno versions prior to 2.8.0
Description
The Node.js compatibility TCP path fails to re-verify network permissions after hostname resolution. While the network permission model is intended to apply rules to the resolved IP address, affected versions check permissions against the original hostname string. An attacker can bypass
--deny-net restrictions by providing a numeric alias of an IP address (such as a decimal integer like 2130706433 or a hexadecimal form like 0x7f000001) which resolves to a denied destination. This bypass occurs when using the { host, port } options form in the node:net.connect() function or the node:http.request() function. This allows less-trusted code to reach protected destinations, such as loopback addresses or internal private ranges, that were explicitly denied.Recommendations
Update to version 2.8.0.
As a temporary workaround, prefer using an
--allow-net allowlist instead of a --deny-net denylist.
Validate untrusted host input to reject hostnames that are purely decimal integers or begin with 0x before passing them to node:net.connect() or node:http.request().
Avoid using the Node options-host path for sensitive calls, opting instead for URL-string forms which are normalized before permission checks.Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Deno