PT-2026-50154 · Deno · Deno

Alcls01111 · CVE-2026-49860 · Published 2026-06-16 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1

Description When opening a WebSocket connection, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the hostname check but resolves to a denied IP, bypassing network isolation rules. This can lead to unauthorized connections to hosts the user intended to block, such as localhost or internal services, potentially via a malicious or compromised dependency.

Recommendations Update to version 2.8.1. Avoid granting --allow-net to untrusted code that relies on --deny-net restrictions for security if an immediate update is not possible.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49860

GHSA-83PC-3RW9-QPWJ

Affected Products

Deno

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49860.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-83pc-3rw9-qpwj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49860 · Security Note
• https://github.com/denoland/deno · Note
• https://t.me/CVEtracker/57697 · Telegram Post