CVE-2026-49411: CWE-284: Improper Access Control in denoland deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.
AI Analysis
Technical Summary
CVE-2026-49411 is an improper access control vulnerability (CWE-284) in denoland's Deno runtime before version 2.8.0. The vulnerability arises because the Node.js compatibility TCP path checks permissions against the original hostname string before DNS resolution but fails to re-check after resolution. An attacker can exploit this by passing numeric aliases of IP addresses (e.g., decimal or hexadecimal forms) that resolve to restricted IPs like 127.0.0.1, thereby bypassing permission checks and reaching otherwise denied destinations via node:net.connect or node:http.request with { host, port } options. This vulnerability is addressed in Deno 2.8.0.
Potential Impact
An attacker with limited privileges can bypass hostname-based permission restrictions by using numeric IP address aliases, potentially allowing unauthorized network connections to restricted destinations such as localhost (127.0.0.1). The vulnerability impacts confidentiality by enabling access to protected network resources. There is no impact on integrity or availability reported.
Mitigation Recommendations
This vulnerability is fixed in Deno version 2.8.0. Users should upgrade to version 2.8.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
CVE-2026-49411: CWE-284: Improper Access Control in denoland deno
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49411 is an improper access control vulnerability (CWE-284) in denoland's Deno runtime before version 2.8.0. The vulnerability arises because the Node.js compatibility TCP path checks permissions against the original hostname string before DNS resolution but fails to re-check after resolution. An attacker can exploit this by passing numeric aliases of IP addresses (e.g., decimal or hexadecimal forms) that resolve to restricted IPs like 127.0.0.1, thereby bypassing permission checks and reaching otherwise denied destinations via node:net.connect or node:http.request with { host, port } options. This vulnerability is addressed in Deno 2.8.0.
Potential Impact
An attacker with limited privileges can bypass hostname-based permission restrictions by using numeric IP address aliases, potentially allowing unauthorized network connections to restricted destinations such as localhost (127.0.0.1). The vulnerability impacts confidentiality by enabling access to protected network resources. There is no impact on integrity or availability reported.
Mitigation Recommendations
This vulnerability is fixed in Deno version 2.8.0. Users should upgrade to version 2.8.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-29T19:08:01.258Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ac4efeed863c81e618237
Added to database: 06/23/2026, 17:39:59 UTC
Last enriched: 06/30/2026, 22:58:03 UTC
Last updated: 08/05/2026, 00:41:15 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.