Network Restriction Bypass in Deno JavaScript Runtime
CVE-2026-49859

5.2MEDIUM

Key Information:

Vendor

Denoland

Status
Deno
Vendor
CVE Published:
23 June 2026

What is CVE-2026-49859?

The Deno JavaScript and TypeScript runtime prior to version 2.8.1 contains a vulnerability that allows an attacker to bypass network restrictions. Specifically, while the runtime validates the destination hostname against defined --deny-net rules, it fails to re-verify the IP addresses that the hostname resolves to. This flaw could enable a malicious script to use a domain name that passes the hostname check but resolves to a blocked IP address, thus completely circumventing intended network restrictions. The issue has been addressed in version 2.8.1, ensuring that both hostname and resolved IP addresses are checked for compliance with the deny list.

Affected Version(s)

deno < 2.8.1

References

https://github.com/denoland/deno/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.