CVE-2026-49859

MEDIUM

Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Title source: cna
STIX 2.1

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

References (1)

Core 1
Core References

Scores

CVSS v3 5.2
EPSS 0.0010
EPSS Percentile 1.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-693 CWE-918
Status published
Products (3)
crates.io/deno 0 - 2.8.1crates.io
deno/deno < 2.8.1
denoland/deno < 2.8.1
Published Jun 23, 2026
Tracked Since Jun 23, 2026