CVE-2026-49411 describes an improper access control vulnerability (CWE-284) in denoland's Deno runtime prior to version 2.8.0. The vulnerability arises because the Node.js compatibility TCP path checks permissions against the original hostname string before DNS resolution but does not re-check after resolution. Attackers can exploit this by providing numeric aliases of IP addresses (e.g., decimal or hexadecimal forms of 127.0.0.1) to bypass permission checks and connect to destinations that should be denied via node:net.connect or node:http.request. This flaw is resolved in Deno 2.8.0.

An attacker with limited privileges (low privilege required) can bypass hostname-based permission checks by using numeric IP address aliases, potentially gaining unauthorized access to network destinations that should be blocked. The vulnerability does not impact confidentiality or availability but allows unauthorized connection establishment, which could lead to information disclosure or other indirect impacts depending on the target service.

This vulnerability is fixed in Deno version 2.8.0. Users should upgrade to version 2.8.0 or later to remediate this issue. No other mitigation or workaround is indicated in the available data.