{"id":"EUVD-2026-38544","enisaUuid":"cc04d756-ea8d-34af-b7dc-b8713572c4e3","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request\u0027s { host, port } options form. This vulnerability is fixed in 2.8.0.","datePublished":"Jun 23, 2026, 5:18:07 PM","dateUpdated":"Jun 26, 2026, 6:56:10 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-v8fw-85r8-5m23\n","aliases":"CVE-2026-49411\nGHSA-v8fw-85r8-5m23\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"0d826ba9-2c1e-3c39-a5d0-b52409027a74","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.0"}],"enisaIdVendor":[{"id":"d9eb6f93-93fb-314b-ae9d-dfedad05c0a9","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"15e45a19-a114-3dc0-9879-6de68eadf401","vulnerability":{"id":"CVE-2026-49411","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request\u0027s { host, port } options form. This vulnerability is fixed in 2.8.0.","datePublished":"Jun 23, 2026, 5:18:07 PM","dateUpdated":"Jun 26, 2026, 6:56:10 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-v8fw-85r8-5m23\n","enisa_id":"EUVD-2026-38544\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"c756ce84-dfb6-39e7-9f9c-3f9dd005ea3d","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.8.0"}],"vulnerabilityVendor":[{"id":"e64e9bc9-7eba-3c48-b6e7-54010fbb5928","vendor":{"name":"denoland"}}]}},{"id":"f35e9fea-ad9c-3f9d-a66f-13abafb6b0cc","vulnerability":{"id":"GHSA-v8fw-85r8-5m23","description":"Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks","datePublished":"Jun 16, 2026, 7:09:46 PM","dateUpdated":"Jul 20, 2026, 9:01:40 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-v8fw-85r8-5m23\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49411\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38544\n","aliases":"CVE-2026-49411\nGHSA-v8fw-85r8-5m23\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}