{"id":"EUVD-2026-38541","enisaUuid":"a1ed1d5a-8482-384c-94db-ed2d2fdab85c","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:14:16 PM","dateUpdated":"Jun 24, 2026, 2:23:09 PM","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2\n","aliases":"CVE-2026-49859\nGHSA-cpgj-f7g3-2pp2\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"f0e7d4f2-86e7-328c-851c-0d570ba9c54d","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"enisaIdVendor":[{"id":"87e5483b-a640-3bee-8a91-e49fb418baac","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"0df1425b-cefe-3cf4-bda4-b0e906382921","vulnerability":{"id":"CVE-2026-49859","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:14:16 PM","dateUpdated":"Jun 24, 2026, 2:23:09 PM","status":"PUBLISHED","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2\n","enisa_id":"EUVD-2026-38541\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Nov 7, 2026, 7:22:47 AM","vulnerabilityProduct":[{"id":"b0ce9c92-d4ea-3c3f-9164-fd51bfb6e4a1","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"vulnerabilityVendor":[{"id":"d34b6cb4-0a81-3ade-90b1-a1aac0414f68","vendor":{"name":"denoland"}}]}},{"id":"895a4017-1814-3425-9dee-14c4613da405","vulnerability":{"id":"GHSA-cpgj-f7g3-2pp2","description":"Deno: `fetch()` API sandbox bypass via missing DNS resolution check","datePublished":"Jun 16, 2026, 7:02:55 PM","dateUpdated":"Jul 20, 2026, 9:01:14 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-cpgj-f7g3-2pp2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49859\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38541\n","aliases":"GHSA-cpgj-f7g3-2pp2\nCVE-2026-49859\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}