CVE-2026-49859CWE-693CWE-918

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Medium · published June 23, 2026

CVSS v3.1
5.2
EPSS
0%
Percentile
3.1
In the wild
Unconfirmed
What it is

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00141 · 3.1th percentile
Weaknesses
CWE-693 · Protection Mechanism Failure; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-23T17:14Z
EPSS history
Timeline
  • 23 JUN 17:14Z
    Deno: `fetch()` API sandbox bypass via missing DNS resolution check
    cvelistv5