Executive brief
Deno is a software runtime used to execute JavaScript and TypeScript applications. A vulnerability in how it handles WebSocket connections allows a remote server to crash a Deno application when the application attempts to connect to it. This results in a denial-of-service, potentially stopping critical business processes or services that rely on external WebSocket data.
Technical details
A denial-of-service vulnerability exists in Deno's WebSocket client implementation due to an uncaught exception (panic) during header parsing. When a Deno application initiates a WebSocket handshake, the remote server can provide 'Sec-WebSocket-Protocol' or 'Sec-WebSocket-Extensions' headers containing non-visible-ASCII bytes (0x80-0xFF). Deno's internal call to HeaderValue::to_str() fails on these bytes, triggering an unrecoverable panic that terminates the process. Exploitation requires the Deno application to connect to a malicious or compromised server, or for an attacker to perform a man-in-the-middle attack on unencrypted (ws://) traffic. The issue is resolved in version 2.7.5 by implementing graceful fallbacks for non-ASCII header values.
Affected products
- denoland Deno < 2.7.5
Timeline
- 2026-06-17: advisory: GitHub advisory published by maintainers
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix released in version 2.7.5