# CVE-2026-55517: Deno denial of service via non-ASCII WebSocket response headers

Source: https://junglewise.ai/threats/cve-2026-55517-deno-denial-of-service-via-non-ascii-websocket-response-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-55517 · Severity: medium · CVSS 4.3 · Published 2026-06-23

Deno is a software runtime used to execute JavaScript and TypeScript applications. A vulnerability in how it handles WebSocket connections allows a remote server to crash a Deno application when the application attempts to connect to it. This results in a denial-of-service, potentially stopping critical business processes or services that rely on external WebSocket data.

Technologies: [deno (crates.io)](https://junglewise.ai/threats/technologies/deno). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-55517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55517 being exploited in the wild.

**How severe is CVE-2026-55517?** Medium severity, with a CVSS score of 4.3, published 23 June 2026.

**Which products and versions are affected?** deno (crates.io) <= 2.7.4, SEMVER:introduced=0,fixed=2.7.5.

**Is there a fix for CVE-2026-55517?** Yes. deno (crates.io): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55517 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55517?** Check whether you run deno (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- deno (crates.io): upgrade to 2.7.5 or later

  ```sh
  cargo update -p deno
  ```


## Technical details

A denial-of-service vulnerability exists in Deno's WebSocket client implementation due to an uncaught exception (panic) during header parsing. When a Deno application initiates a WebSocket handshake, the remote server can provide 'Sec-WebSocket-Protocol' or 'Sec-WebSocket-Extensions' headers containing non-visible-ASCII bytes (0x80-0xFF). Deno's internal call to HeaderValue::to_str() fails on these bytes, triggering an unrecoverable panic that terminates the process. Exploitation requires the Deno application to connect to a malicious or compromised server, or for an attacker to perform a man-in-the-middle attack on unencrypted (ws://) traffic. The issue is resolved in version 2.7.5 by implementing graceful fallbacks for non-ASCII header values.

## Affected products

- denoland Deno < 2.7.5

## Identifiers

- CVE-2026-55517
- GHSA-x2qc-cmh9-f4hf

## Timeline

- 2026-06-17: advisory: GitHub advisory published by maintainers
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix released in version 2.7.5

## References

- [https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf](https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf)

## Related threats

- [Deno environment permission bypass in process.loadEnvFile](https://junglewise.ai/threats/cve-2026-49983-deno-environment-permission-bypass-in-process-loadenvfile)
- [Deno sandbox bypass via missing post-DNS check in WebSocket API](https://junglewise.ai/threats/cve-2026-49860-deno-sandbox-bypass-via-missing-post-dns-check-in-websocket-api)
- [Deno network restriction bypass in fetch API](https://junglewise.ai/threats/cve-2026-49859-deno-network-restriction-bypass-in-fetch-api)
- [Deno missing cryptographic rounds in node:crypto checkPrime](https://junglewise.ai/threats/cve-2026-49440-deno-missing-cryptographic-rounds-in-node-crypto-checkprime)
- [Deno network permission bypass via numeric hostname aliases in Node.js compatibility layer](https://junglewise.ai/threats/cve-2026-49411-deno-network-permission-bypass-via-numeric-hostname-aliases-in)