Deno Runtime Hostname Permission Bypass Vulnerability

CVE-2026-49411

What is CVE-2026-49411?

Before version 2.8.0, the Deno runtime exhibited a vulnerability in its Node.js compatibility TCP path. The system initially checked permissions against the original hostname string prior to resolution but did not perform a subsequent re-check after resolution. This flaw allowed adversaries to utilize numeric IP address aliases (such as 2130706433 or 0x7f000001, both of which correspond to 127.0.0.1) to bypass restrictions and access denied destinations through functions like node:net.connect or node:http.request with specified { host, port } options. This issue has been addressed in Deno version 2.8.0.

References