Security: denoland/deno
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
process.loadEnvFile() bypasses env permission checks and mutates process.env with only read accessGHSA-4c8g-jvcx-v4hv published
May 27, 2026 by bartlomiejuModerate -
WebSocket API sandbox bypass via missing post-DNS checkGHSA-83pc-3rw9-qpwj published
May 27, 2026 by bartlomiejuModerate -
`fetch()` API sandbox bypass via missing DNS resolution checkGHSA-cpgj-f7g3-2pp2 published
May 27, 2026 by bartlomiejuModerate -
Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checksGHSA-v8fw-85r8-5m23 published
May 27, 2026 by bartlomiejuModerate -
Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)GHSA-8xpq-cjcf-3wh9 published
May 27, 2026 by bartlomiejuHigh -
Miller-Rabin Primality Test Allows Zero RoundsGHSA-9xg4-qhm4-g43w published
May 27, 2026 by bartlomiejuHigh -
BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictionsGHSA-968w-xfqw-vp9q published
May 27, 2026 by bartlomiejuModerate -
TLS retry copies stale upgrade hook, risking plaintext trafficGHSA-chqv-56wv-7564 published
May 27, 2026 by bartlomiejuHigh -
Command Injection via spawnSync & spawn on WindowsGHSA-7xh3-mhg9-jcw8 published
May 27, 2026 by bartlomiejuHigh -
Denial of service via non-ASCII bytes in WebSocket response headersGHSA-x2qc-cmh9-f4hf published
Jun 17, 2026 by bartlomiejuModerate