Browse CVEs

MEDIUM 5.2 CVE-2026-49860 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostn… Deno 2.8.1+ Fix from $1,6002026-06-23 MEDIUM 5.2 CVE-2026-49983 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --… Deno 2.8.1+ Fix from $1,6002026-06-23 HIGH 8.4 CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions b… Deno 2.7.14+ Fix from $1,9502026-06-23 HIGH 8.1 CVE-2026-49402 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() hel… Deno 2.7.10+ Fix from $1,9502026-06-23 HIGH 7.4 CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkP… Deno 2.8.1+ Fix from $1,9502026-06-23 MEDIUM 6.5 CVE-2026-49411 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the orig… Deno 2.8.0+ Fix from $1,6002026-06-23 MEDIUM 5.5 CVE-2026-49406 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module re… Deno 2.7.12+ Fix from $1,6002026-06-23 MEDIUM 5.2 CVE-2026-49859 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --d… Deno 2.8.1+ Fix from $1,6002026-06-23 CRITICAL 9.1 CVE-2026-44726 Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS… Deno 2.7.8+ Fix from $2,3002026-06-23 CRITICAL 9.8 CVE-2026-32260 Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_proces… Deno 2.7.2+ Fix from $2,3002026-03-12 CRITICAL 9.8 CVE-2026-27190 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process impl… Deno 2.6.8+ Fix from $2,3002026-02-20 CRITICAL 9.8 CVE-2026-22864 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning… Deno 2.5.6+ Fix from $2,3002026-01-15 HIGH 7.5 CVE-2026-22863 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to… Deno 2.6.0+ Fix from $1,9502026-01-15 HIGH 8.1 CVE-2025-61787 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Win… Deno 2.5.3+ Fix from $1,9502025-10-08 CRITICAL 9.1 CVE-2025-48935 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's per… Deno 2.2.5+ Fix from $2,3002025-06-04 MEDIUM 5.3 CVE-2025-48934 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables … Deno 2.1.13 / 2.2.13+ Fix from $1,6002025-06-04 MEDIUM 5.3 CVE-2025-48888 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --al… Deno 2.1.13 / 2.2.13+ Fix from $1,6002025-06-04 MEDIUM 5.3 CVE-2025-24015 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in De… Deno 2.1.7+ Fix from $1,6002025-06-03 MEDIUM 6.5 CVE-2024-37150 An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the regis… Deno Patch available Fix from $1,6002024-06-06 CRITICAL 9.0 CVE-2024-34346 Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/w… Deno 1.43.1+ Fix from $2,3002024-05-07 HIGH 7.4 CVE-2024-32477 Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, l… Deno 1.42.2+ Fix from $1,9502024-04-18 HIGH 8.8 CVE-2024-27933 Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature … Deno Patch available Fix from $1,9502024-03-21 HIGH 8.8 CVE-2024-27934 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c… Deno 1.40.3+ Fix from $1,9502024-03-21 HIGH 8.3 CVE-2024-27935 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js … Deno 1.36.3+ Fix from $1,9502024-03-21 MEDIUM 6.5 CVE-2024-27936 Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno li… Deno Runtime 0.147.0 / 1.41.0+ Fix from $1,6002024-03-21 MEDIUM 6.5 CVE-2024-27931 Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would … Deno 1.41.1+ Fix from $1,6002024-03-05 CRITICAL 9.8 CVE-2023-33966 Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` … Deno Runtime Mitigation only Fix from $2,3002023-05-31 HIGH 8.8 CVE-2023-28446 Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI… Deno 1.31.2+ Fix from $1,9502023-03-24 CRITICAL 9.8 CVE-2023-28445 Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are s… Deno Runtime Patch available Fix from $2,3002023-03-24 HIGH 7.5 CVE-2023-26103 Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which… Deno 1.31.0+ Fix from $1,9502023-02-25