{"id":"EUVD-2026-38542","enisaUuid":"53525fa3-36b3-31d1-a080-ab4d8a399362","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:15:05 PM","dateUpdated":"Jun 23, 2026, 5:37:07 PM","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj\n","aliases":"CVE-2026-49860\nGHSA-83pc-3rw9-qpwj\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"af0b5a1c-d5a2-3324-9a93-0d5b1458c42e","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"enisaIdVendor":[{"id":"29be833d-186b-3297-b165-5c240e05bf31","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"1265eec2-71a8-3692-a1bd-3952d984e324","vulnerability":{"id":"GHSA-83pc-3rw9-qpwj","description":"Deno: WebSocket API sandbox bypass via missing post-DNS check","datePublished":"Jun 16, 2026, 7:04:07 PM","dateUpdated":"Jul 20, 2026, 9:01:04 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49860\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38542\n","aliases":"CVE-2026-49860\nGHSA-83pc-3rw9-qpwj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"91be263a-ddbf-3ac2-b03a-e4dd142fc479","vulnerability":{"id":"CVE-2026-49860","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.","datePublished":"Jun 23, 2026, 5:15:05 PM","dateUpdated":"Jun 23, 2026, 5:37:07 PM","status":"PUBLISHED","baseScore":5.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-83pc-3rw9-qpwj\n","enisa_id":"EUVD-2026-38542\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Nov 5, 2026, 7:19:06 AM","vulnerabilityProduct":[{"id":"a0bb750e-b1cb-3326-8976-d007843f1a08","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.1"}],"vulnerabilityVendor":[{"id":"efd391fd-36f2-3eac-8535-0b8570c00744","vendor":{"name":"denoland"}}]}}],"enisaIdAdvisory":[]}