Executive brief
Deno is a runtime used to execute JavaScript and TypeScript applications. A security flaw in its Node.js compatibility layer allows code to bypass network restrictions (the --deny-net flag) by using alternative numeric formats for IP addresses, such as decimal or hexadecimal aliases. This could allow a malicious script or dependency to access restricted internal services, such as local databases or cloud metadata endpoints, that were intended to be blocked.
Technical details
A vulnerability exists in Deno's Node.js compatibility TCP path (specifically affecting node:net.connect and node:http.request when using the options object form). The runtime checks network permissions against the raw hostname string provided by the caller but fails to re-check permissions after the hostname is resolved to an IP address. An attacker can exploit this by providing numeric aliases of IP addresses (e.g., decimal 2130706433 or hex 0x7f000001 for 127.0.0.1), which bypasses string-based 'deny' rules. This allows unauthorized access to restricted network destinations like loopback or internal IP ranges. The issue is fixed in version 2.8.0; native Deno APIs and URL-string based requests are not affected as they perform proper normalization or post-resolution checks.
Affected products
- denoland deno < 2.8.0
Timeline
- 2026-05-27: advisory: GitHub advisory published by maintainers
- 2026-06-23: disclosed: CVE published to NVD
- 2026-05-27: patched: Fixed in version 2.8.0