Deno (crates.io)
Advisories
44
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.8.1 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p Deno --precise 2.8.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-x2qc-cmh9-f4hf Deno: Denial of service via non-ASCII bytes in WebSocket response headers |
Medium EPSS 0.32% |
< 2.7.5 | 2.7.5 |
| GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) |
High EPSS 0.20% |
< 2.7.14 | 2.7.14 |
| GHSA-968w-xfqw-vp9q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions |
Medium EPSS 0.18% |
< 2.7.12 | 2.7.12 |
| GHSA-v8fw-85r8-5m23 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks |
Medium EPSS 0.16% |
< 2.8.0 | 2.8.0 |
| GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds |
High EPSS 0.24% |
< 2.8.1 | 2.8.1 |
| GHSA-7xh3-mhg9-jcw8 Deno: Command Injection via spawnSync & spawn on Windows |
High EPSS 0.45% |
< 2.7.10 | 2.7.10 |
| GHSA-4c8g-jvcx-v4hv Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access |
Medium EPSS 0.14% |
< 2.8.1 | 2.8.1 |
| GHSA-83pc-3rw9-qpwj Deno: WebSocket API sandbox bypass via missing post-DNS check |
Medium EPSS 0.14% |
< 2.8.1 | 2.8.1 |
| GHSA-cpgj-f7g3-2pp2 Deno: `fetch()` API sandbox bypass via missing DNS resolution check |
Medium EPSS 0.14% |
< 2.8.1 | 2.8.1 |
| GHSA-chqv-56wv-7564 Deno's TLS retry copies stale upgrade hook, risking plaintext traffic |
Critical EPSS 0.23% |
>= 2.0.0, < 2.7.8 | 2.7.8 |
| GHSA-4c96-w8v2-p28j Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process |
Critical EPSS 1.54% |
>= 2.7.0, < 2.7.2 | 2.7.2 |
| GHSA-hmh4-3xvx-q5hr Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process |
Critical EPSS 2.46% |
< 2.6.8 | 2.6.8 |
| GHSA-m3c4-prhw-mrx6 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass |
Critical EPSS 0.67% |
< 2.5.6 | 2.5.6 |
| GHSA-5379-f5hf-w38v Deno node:crypto doesn't finalize cipher |
High EPSS 0.20% |
< 2.6.0 | 2.6.0 |
| GHSA-m2gf-x3f6-8hq3 Deno is Vulnerable to Command Injection on Windows During Batch File Execution |
High EPSS 2.08% |
< 2.5.2 | 2.5.2 |
| GHSA-qq26-84mh-26j9 Deno's --deny-read check does not prevent permission bypass |
Low EPSS 0.20% |
< 2.5.3 | 2.5.3 |
| GHSA-vg2r-rmgp-cgqj Deno's --deny-write check does not prevent permission bypass |
Low EPSS 0.20% |
< 2.5.3 | 2.5.3 |
| GHSA-jv4x-jv3h-qff5 Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium | < 2.0.0 | 2.0.0 |
| GHSA-7w8p-chxq-2789 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables |
Medium EPSS 0.44% |
>= 2.2.0, < 2.2.13 | 2.2.13 |
| GHSA-7w8p-chxq-2789 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables |
Medium EPSS 0.44% |
< 2.1.13 | 2.1.13 |
| GHSA-xqxc-x6p3-w683 Deno run with --allow-read and --deny-read flags results in allowed |
Medium EPSS 0.42% |
>= 1.41.3, < 2.1.13 | 2.1.13 |
| GHSA-xqxc-x6p3-w683 Deno run with --allow-read and --deny-read flags results in allowed |
Medium EPSS 0.42% |
>= 2.2.0, < 2.2.13 | 2.2.13 |
| GHSA-xqxc-x6p3-w683 Deno run with --allow-read and --deny-read flags results in allowed |
Medium EPSS 0.42% |
>= 2.3.0, < 2.3.2 | 2.3.2 |
| GHSA-2x3r-hwv5-p32x Deno's AES GCM authentication tags are not verified |
Medium EPSS 0.29% |
>= 1.46.0, < 2.1.7 | 2.1.7 |
| GHSA-8vxj-4cph-c596 Deno has --allow-read / --allow-write permission bypass in `node:sqlite` |
Critical EPSS 0.49% |
>= 2.2.0, < 2.2.5 | 2.2.5 |
| GHSA-8vxj-4cph-c596 Deno has --allow-read / --allow-write permission bypass in `node:sqlite` |
Critical EPSS 0.49% |
>= 2.2.0, < 2.2.5 | 2.2.5 |
| GHSA-f27p-cmv8-xhm6 fetch: Authorization headers not dropped when redirecting cross-origin |
High EPSS 0.52% |
>= 2.0.0, < 2.1.2 | 2.1.2 |
| GHSA-f27p-cmv8-xhm6 fetch: Authorization headers not dropped when redirecting cross-origin |
High EPSS 0.52% |
<= 1.46.3 | No fix yet |
| GHSA-23rx-c3g5-hv9w Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag |
Critical EPSS 0.37% |
< 1.43.1 | 1.43.1 |
| GHSA-3j27-563v-28wf *const c_void / ExternalPointer unsoundness leading to use-after-free |
High EPSS 0.39% |
>= 1.36.2, < 1.40.3 | 1.40.3 |
| GHSA-6q4w-9x56-rmwq Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass |
High EPSS 2.28% |
>= 1.39.0, < 1.39.1 | 1.39.1 |
| GHSA-5frw-4rwq-xhcr Deno's improper suffix match testing for DENO_AUTH_TOKENS |
Medium EPSS 0.59% |
>= 1.8.0, < 1.40.4 | 1.40.4 |
| GHSA-m4pq-fv2w-6hrw Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping |
Medium EPSS 0.94% |
>= 1.32.1, < 1.41.0 | 1.41.0 |
| GHSA-wrqv-pf6j-mqjp Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination |
High EPSS 0.72% |
>= 1.35.1, < 1.36.3 | 1.36.3 |
| GHSA-hrqr-jv8w-v9jh Insufficient permission checking in `Deno.makeTemp*` APIs |
Medium EPSS 0.49% |
< 1.41.1 | 1.41.1 |
| GHSA-vc52-gwm3-8v2f Missing "--allow-net" permission check for built-in Node modules |
Critical EPSS 0.62% |
>= 1.34.0, < 1.34.1 | 1.34.1 |
| GHSA-vq67-rp93-65qf Interactive `run` permission prompt spoofing via improper ANSI neutralization |
High EPSS 1.13% |
>= 1.8.0, < 1.31.2 | 1.31.2 |
| GHSA-c25x-cm9x-qqgx Deno improperly handles resizable ArrayBuffer |
Critical EPSS 0.97% |
>= 1.32.0, < 1.32.1 | 1.32.1 |
| GHSA-xr9w-x6gw-c9mj Duplicate advisory: Deno vulnerable to Regular Expression Denial of Service Withdrawn |
High | < 1.31.0 | 1.31.0 |
| GHSA-jc97-h3h9-7xh6 Regular Expression Denial of Service in Deno.upgradeWebSocket API |
High EPSS 1.23% |
>= 1.12.0, < 1.31.0 | 1.31.0 |
| GHSA-mc52-jpm2-cqh6 Deno is vulnerable to race condition via interactive permission prompt spoofing |
High EPSS 0.62% |
>= 1.9.0, < 1.29.3 | 1.29.3 |
| GHSA-67hm-27mx-9cg7 Link Following in Deno |
High EPSS 0.38% |
< 1.16.0 | 1.16.0 |
| GHSA-838h-jqp6-cf2f Sandbox bypass leading to arbitrary code execution in Deno |
Critical EPSS 1.15% |
>= 1.18.0, < 1.20.3 | 1.20.3 |
| GHSA-xpwj-7v8q-mcgj Deno's static imports inside dynamically imported modules do not adhere to permission checks |
Critical EPSS 1.11% |
>= 1.5.0, < 1.10.2 | 1.10.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor