In Deno before version 2.8.1, the fetch() API performed network access control by checking the destination hostname against configured --deny-net rules. However, it did not re-validate the IP addresses that the hostname resolved to, allowing an attacker to craft a domain name that passes the hostname check but resolves to an IP address that should be denied. This constitutes a protection mechanism failure (CWE-693) and improper control of resource access (CWE-918). The vulnerability is addressed in Deno 2.8.1 by ensuring IP addresses are checked against deny-net rules after DNS resolution.

An attacker controlling a script running in a vulnerable Deno environment could bypass network restrictions configured via --deny-net by exploiting the hostname-to-IP resolution gap. This could lead to unauthorized network access to IP addresses that are intended to be blocked, potentially exposing sensitive internal resources or services. The CVSS score of 5.2 reflects a medium severity with limited privileges required and no user interaction needed.

Upgrade Deno to version 2.8.1 or later, where this vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 2.8.1, applying this official fix fully mitigates the risk. No additional mitigations are indicated.