CVE-2026-49859: deno Protection Mechanism Failure
Vulnerability summary
CVE-2026-49859 is a medium (CVSS 5.2) Protection Mechanism Failure vulnerability in deno. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.1% of scored vulnerabilities.
Timeline
- 23-06-2026PublishedVulnerability first disclosed.
- 24-06-2026Last modifiedVulnerability information updated.
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · Crates.ioEcosystem advisory · calculated5.2MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- NVDNIST5.2MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.14% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
3 vendors · 3 products
References
3 links- github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2X Refsource CONFIRMWEBVendor Advisory
- github.com/denoland/denoPACKAGE