CVE-2026-55517: Deno denial of service via non-ASCII WebSocket response headers

CVE-2026-55517 · Severity: medium · CVSS 4.3 · Published 2026-06-23

Deno is a software runtime used to execute JavaScript and TypeScript applications. A vulnerability in how it handles WebSocket connections allows a remote server to crash a Deno application when the application attempts to connect to it. This results in a denial-of-service, potentially stopping critical business processes or services that rely on external WebSocket data.

Technologies: deno (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-55517 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55517 being exploited in the wild.
How severe is CVE-2026-55517?
Medium severity, with a CVSS score of 4.3, published 23 June 2026.
Which products and versions are affected?
deno (crates.io) <= 2.7.4, SEMVER:introduced=0,fixed=2.7.5.
Is there a fix for CVE-2026-55517?
Yes. deno (crates.io): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55517 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55517?
Check whether you run deno (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • deno (crates.io): upgrade to 2.7.5 or later
    cargo update -p deno

Technical details

A denial-of-service vulnerability exists in Deno's WebSocket client implementation due to an uncaught exception (panic) during header parsing. When a Deno application initiates a WebSocket handshake, the remote server can provide 'Sec-WebSocket-Protocol' or 'Sec-WebSocket-Extensions' headers containing non-visible-ASCII bytes (0x80-0xFF). Deno's internal call to HeaderValue::to_str() fails on these bytes, triggering an unrecoverable panic that terminates the process. Exploitation requires the Deno application to connect to a malicious or compromised server, or for an attacker to perform a man-in-the-middle attack on unencrypted (ws://) traffic. The issue is resolved in version 2.7.5 by implementing graceful fallbacks for non-ASCII header values.

Affected products

  • denoland Deno < 2.7.5

Identifiers

  • CVE-2026-55517
  • GHSA-x2qc-cmh9-f4hf

Timeline

  • 2026-06-17: advisory: GitHub advisory published by maintainers
  • 2026-06-23: disclosed: NVD publication date
  • 2026-06-23: patched: Fix released in version 2.7.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.