# deno (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/deno Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/deno.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 39 vulnerabilities in deno (crates.io): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55517, was published on 23 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 39 (0 critical, 0 exploited in the wild) ## About deno (crates.io) Deno is a runtime for JavaScript, TypeScript, and WebAssembly based on the V8 JavaScript engine and the Rust programming language. ## Latest deno (crates.io) vulnerabilities - [CVE-2026-55517: Deno denial of service via non-ASCII WebSocket response headers](https://junglewise.ai/threats/cve-2026-55517-deno-denial-of-service-via-non-ascii-websocket-response-headers) (medium, CVSS 4.3, published 23 Jun 2026) - [CVE-2026-49983: Deno environment permission bypass in process.loadEnvFile](https://junglewise.ai/threats/cve-2026-49983-deno-environment-permission-bypass-in-process-loadenvfile) (medium, CVSS 5.2, published 23 Jun 2026) - [CVE-2026-49860: Deno sandbox bypass via missing post-DNS check in WebSocket API](https://junglewise.ai/threats/cve-2026-49860-deno-sandbox-bypass-via-missing-post-dns-check-in-websocket-api) (medium, CVSS 5.2, published 23 Jun 2026) - [CVE-2026-49859: Deno network restriction bypass in fetch API](https://junglewise.ai/threats/cve-2026-49859-deno-network-restriction-bypass-in-fetch-api) (medium, CVSS 5.2, published 23 Jun 2026) - [CVE-2026-49440: Deno missing cryptographic rounds in node:crypto checkPrime](https://junglewise.ai/threats/cve-2026-49440-deno-missing-cryptographic-rounds-in-node-crypto-checkprime) (high, CVSS 7.4, published 23 Jun 2026) - [CVE-2026-49411: Deno network permission bypass via numeric hostname aliases in Node.js compatibility layer](https://junglewise.ai/threats/cve-2026-49411-deno-network-permission-bypass-via-numeric-hostname-aliases-in) (medium, CVSS 6.5, published 23 Jun 2026) - [CVE-2026-49406: Deno path traversal and permission bypass in BYONM module resolution](https://junglewise.ai/threats/cve-2026-49406-deno-path-traversal-and-permission-bypass-in-byonm-module) (medium, CVSS 5.5, published 23 Jun 2026) - [CVE-2026-49402: Deno OS command injection in node:child_process on Windows](https://junglewise.ai/threats/cve-2026-49402-deno-os-command-injection-in-node-child-process-on-windows) (high, CVSS 8.1, published 23 Jun 2026) - [CVE-2026-49401: Deno permission bypass via Unicode normalization mismatch on macOS](https://junglewise.ai/threats/cve-2026-49401-deno-permission-bypass-via-unicode-normalization-mismatch-on) (high, CVSS 7.3, published 23 Jun 2026) - [CVE-2026-44726: Deno cleartext transmission in Node.js TLS compatibility layer](https://junglewise.ai/threats/cve-2026-44726-deno-plaintext-data-transmission-in-node-js-tls-compatibility) (high, CVSS 7.4, published 27 May 2026) - [CVE-2026-32260: Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process](https://junglewise.ai/threats/cve-2026-32260-deno-vulnerable-to-command-injection-via-incomplete-shell) (low, CVSS 3.1, published 13 Mar 2026) - [CVE-2026-27190: Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process](https://junglewise.ai/threats/cve-2026-27190-deno-has-a-command-injection-via-incomplete-shell-metacharacter) (low, CVSS 3.1, published 19 Feb 2026) - [CVE-2026-22864: Deno command injection via case-insensitive extension bypass on Windows](https://junglewise.ai/threats/cve-2026-22864-deno-command-injection-via-case-insensitive-extension-bypass-on) (high, CVSS 8.1, published 16 Jan 2026) - [CVE-2026-22863: Deno node:crypto doesn't finalize cipher](https://junglewise.ai/threats/cve-2026-22863-deno-node-crypto-doesn-t-finalize-cipher) (medium, CVSS 4, published 16 Jan 2026) - [CVE-2025-61787: Deno is Vulnerable to Command Injection on Windows During Batch File Execution](https://junglewise.ai/threats/cve-2025-61787-deno-is-vulnerable-to-command-injection-on-windows-during-batch) (low, CVSS 3.1, published 8 Oct 2025) - [CVE-2025-61786: Deno's --deny-read check does not prevent permission bypass](https://junglewise.ai/threats/cve-2025-61786-deno-s-deny-read-check-does-not-prevent-permission-bypass) (low, CVSS 3.1, published 8 Oct 2025) - [CVE-2025-61785: Deno's --deny-write check does not prevent permission bypass](https://junglewise.ai/threats/cve-2025-61785-deno-s-deny-write-check-does-not-prevent-permission-bypass) (low, CVSS 3, published 7 Oct 2025) - [CVE-2024-21486: Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor](https://junglewise.ai/threats/cve-2024-21486-deno-vulnerable-to-exposure-of-sensitive-information-to-an) (low, CVSS 3.1, published 5 Jun 2025) - [CVE-2025-48934: Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables](https://junglewise.ai/threats/cve-2025-48934-deno-env-toobject-ignores-the-variables-listed-in-deny-env-and) (low, CVSS 3.1, published 4 Jun 2025) - [CVE-2025-48888: Deno run with --allow-read and --deny-read flags results in allowed](https://junglewise.ai/threats/cve-2025-48888-deno-run-with-allow-read-and-deny-read-flags-results-in-allowed) (low, CVSS 3.1, published 4 Jun 2025) - [CVE-2025-24015: Deno's AES GCM authentication tags are not verified](https://junglewise.ai/threats/cve-2025-24015-deno-s-aes-gcm-authentication-tags-are-not-verified) (medium, CVSS 4, published 4 Jun 2025) - [CVE-2025-48935: RUSTSEC-2025-0138 - --allow-read / --allow-write permission bypass in `node:sqlite`](https://junglewise.ai/threats/cve-2025-48935-deno-has-allow-read-allow-write-permission-bypass-in-node-sqlite) (medium, CVSS 4, published 3 Jun 2025) - [CVE-2025-21620: fetch: Authorization headers not dropped when redirecting cross-origin](https://junglewise.ai/threats/cve-2025-21620-fetch-authorization-headers-not-dropped-when-redirecting-cross) (low, CVSS 3, published 6 Jan 2025) - [CVE-2024-34346: Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag](https://junglewise.ai/threats/cve-2024-34346-deno-permission-escalation-vulnerability-via-open-of-privileged) (low, CVSS 3.1, published 8 May 2024) - [CVE-2024-27934: *const c_void / ExternalPointer unsoundness leading to use-after-free](https://junglewise.ai/threats/cve-2024-27934-const-c-void-externalpointer-unsoundness-leading-to-use-after) (low, CVSS 3.1, published 6 Mar 2024) ## Most severe deno (crates.io) vulnerabilities - [CVE-2026-22864: Deno command injection via case-insensitive extension bypass on Windows](https://junglewise.ai/threats/cve-2026-22864-deno-command-injection-via-case-insensitive-extension-bypass-on) (high, CVSS 8.1, published 16 Jan 2026) - [CVE-2026-49402: Deno OS command injection in node:child_process on Windows](https://junglewise.ai/threats/cve-2026-49402-deno-os-command-injection-in-node-child-process-on-windows) (high, CVSS 8.1, published 23 Jun 2026) - [CVE-2026-49440: Deno missing cryptographic rounds in node:crypto checkPrime](https://junglewise.ai/threats/cve-2026-49440-deno-missing-cryptographic-rounds-in-node-crypto-checkprime) (high, CVSS 7.4, published 23 Jun 2026) - [CVE-2026-44726: Deno cleartext transmission in Node.js TLS compatibility layer](https://junglewise.ai/threats/cve-2026-44726-deno-plaintext-data-transmission-in-node-js-tls-compatibility) (high, CVSS 7.4, published 27 May 2026) - [CVE-2026-49401: Deno permission bypass via Unicode normalization mismatch on macOS](https://junglewise.ai/threats/cve-2026-49401-deno-permission-bypass-via-unicode-normalization-mismatch-on) (high, CVSS 7.3, published 23 Jun 2026) - [CVE-2026-49411: Deno network permission bypass via numeric hostname aliases in Node.js compatibility layer](https://junglewise.ai/threats/cve-2026-49411-deno-network-permission-bypass-via-numeric-hostname-aliases-in) (medium, CVSS 6.5, published 23 Jun 2026) - [CVE-2026-49406: Deno path traversal and permission bypass in BYONM module resolution](https://junglewise.ai/threats/cve-2026-49406-deno-path-traversal-and-permission-bypass-in-byonm-module) (medium, CVSS 5.5, published 23 Jun 2026) - [CVE-2026-49983: Deno environment permission bypass in process.loadEnvFile](https://junglewise.ai/threats/cve-2026-49983-deno-environment-permission-bypass-in-process-loadenvfile) (medium, CVSS 5.2, published 23 Jun 2026) - [CVE-2026-49860: Deno sandbox bypass via missing post-DNS check in WebSocket API](https://junglewise.ai/threats/cve-2026-49860-deno-sandbox-bypass-via-missing-post-dns-check-in-websocket-api) (medium, CVSS 5.2, published 23 Jun 2026) - [CVE-2026-49859: Deno network restriction bypass in fetch API](https://junglewise.ai/threats/cve-2026-49859-deno-network-restriction-bypass-in-fetch-api) (medium, CVSS 5.2, published 23 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "deno (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/deno, 9 November 2026.