VYPR
← All advisories
Medium severity6.5GHSA Advisory· Published Jun 23, 2026· Updated Jun 26, 2026

CVE-2026-49411

CVE-2026-49411

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
denocrates.io
< 2.8.02.8.0

Affected products

2
  • Denoland/Deno2 versions
    cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*range: >=2.7.14,<2.8.0
    • (no CPE)range: <= 2.7.14

Patches

Vulnerability mechanics

References

3

News mentions

1