CVE-2026-49860: CWE-918: Server-Side Request Forgery (SSRF) in denoland deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.
AI Analysis
Technical Summary
CVE-2026-49860 is a Server-Side Request Forgery (SSRF) vulnerability in denoland's Deno runtime prior to version 2.8.1. The vulnerability arises because Deno only checked the hostname against --deny-net rules when establishing WebSocket connections, without revalidating the IP addresses that the hostname resolved to. An attacker-controlled script could exploit this by using a crafted domain name that passes the hostname check but resolves to an IP address that should be denied, effectively bypassing network restrictions. This vulnerability was addressed and fixed in Deno version 2.8.1.
Potential Impact
An attacker with the ability to run scripts in Deno could bypass network restrictions configured via --deny-net by exploiting the hostname-to-IP resolution flaw during WebSocket connections. This could lead to unauthorized network access to otherwise blocked IP addresses, potentially exposing internal or sensitive network resources. The CVSS score of 5.2 reflects a medium severity with limited privileges required and partial confidentiality and integrity impact.
Mitigation Recommendations
Upgrade Deno to version 2.8.1 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed fixed in 2.8.1.
CVE-2026-49860: CWE-918: Server-Side Request Forgery (SSRF) in denoland deno
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.
CVSS v3.1
Score 5.2medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49860 is a Server-Side Request Forgery (SSRF) vulnerability in denoland's Deno runtime prior to version 2.8.1. The vulnerability arises because Deno only checked the hostname against --deny-net rules when establishing WebSocket connections, without revalidating the IP addresses that the hostname resolved to. An attacker-controlled script could exploit this by using a crafted domain name that passes the hostname check but resolves to an IP address that should be denied, effectively bypassing network restrictions. This vulnerability was addressed and fixed in Deno version 2.8.1.
Potential Impact
An attacker with the ability to run scripts in Deno could bypass network restrictions configured via --deny-net by exploiting the hostname-to-IP resolution flaw during WebSocket connections. This could lead to unauthorized network access to otherwise blocked IP addresses, potentially exposing internal or sensitive network resources. The CVSS score of 5.2 reflects a medium severity with limited privileges required and partial confidentiality and integrity impact.
Mitigation Recommendations
Upgrade Deno to version 2.8.1 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed fixed in 2.8.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-01T22:03:19.640Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ac4f0eed863c81e61824b
Added to database: 06/23/2026, 17:40:00 UTC
Last enriched: 06/23/2026, 17:55:09 UTC
Last updated: 08/04/2026, 16:47:48 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.