{"id":"EUVD-2026-38549","enisaUuid":"323d41f3-a559-323b-a239-6b790278c7c0","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.","datePublished":"Jun 23, 2026, 5:24:59 PM","dateUpdated":"Jun 23, 2026, 5:52:56 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","references":"https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf\n","aliases":"CVE-2026-55517\nGHSA-x2qc-cmh9-f4hf\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"2f56fe17-07c7-3c5e-9b2c-b732b0c78c24","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.5"}],"enisaIdVendor":[{"id":"8f1dc323-a47f-3722-838b-610735422207","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"8c039464-0fbb-3823-946f-669f62197d1d","vulnerability":{"id":"CVE-2026-55517","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.","datePublished":"Jun 23, 2026, 5:24:59 PM","dateUpdated":"Jun 23, 2026, 5:52:56 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","references":"https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf\n","enisa_id":"EUVD-2026-38549\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"487576b9-51ab-3c8c-8495-e78522cde4ee","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"\u003c 2.7.5"}],"vulnerabilityVendor":[{"id":"107d70f1-d352-3a04-9388-90f6b6d1944a","vendor":{"name":"denoland"}}]}},{"id":"ef654b5b-c575-37cb-9e02-11326e0bcb04","vulnerability":{"id":"GHSA-x2qc-cmh9-f4hf","description":"Deno: Denial of service via non-ASCII bytes in WebSocket response headers","datePublished":"Jun 17, 2026, 6:48:18 PM","dateUpdated":"Jun 17, 2026, 6:48:18 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38549\n","aliases":"CVE-2026-55517\nGHSA-x2qc-cmh9-f4hf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}