Back to overview

CVE-2026-49411

MEDIUM
6.5
CVSS 3.1
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.

Metadata

CVE ID
CVE-2026-49411
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-29 19:08 UTC
Published
2026-06-23 17:18 UTC
Last updated
2026-06-23 17:18 UTC
Primary CWE
CWE-284
CWE-284: Improper Access Control
Vendor / Product
denoland / deno
Sources
cve.org  ·  NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
denoland deno — < 2.8.0
Weakness (CWE)
CWESourceDescription
CWE-284 cna CWE-284: Improper Access Control
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.5 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References (1)
Back to overview