Deno

This hub aggregates every CVE we track for Deno, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Deno.

• CVE-2026-55517Deno: Denial of service via non-ASCII bytes in WebSocket response headers4.3Jun 23, 2026
• CVE-2026-44726Deno: TLS retry copies stale upgrade hook, risking plaintext traffic7.4Jun 23, 2026
• CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)7.3Jun 23, 2026
• CVE-2026-49402Deno: Command Injection via spawnSync & spawn on Windows8.1Jun 23, 2026
• CVE-2026-49406Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions5.5Jun 23, 2026
• CVE-2026-49411Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks6.5Jun 23, 2026
• CVE-2026-49983Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access5.2Jun 23, 2026
• CVE-2026-49860Deno: WebSocket API sandbox bypass via missing post-DNS check5.2Jun 23, 2026
• CVE-2026-49859Deno: `fetch()` API sandbox bypass via missing DNS resolution check5.2Jun 23, 2026
• CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Rounds7.4Jun 23, 2026
• CVE-2026-32260Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)8.1Mar 12, 2026
• CVE-2026-27190Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process8.1Feb 20, 2026
• CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass8.1Jan 15, 2026
• CVE-2026-22863Deno node:crypto doesn't finalize cipher7.5Jan 15, 2026
• CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Execution8.1Oct 8, 2025