CVEs we hold for Denoland

Records whose assigning authority named Denoland as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-55517Deno: Denial of service via non-ASCII bytes in WebSocket response headersdenoland deno

CVE-2026-49983Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read accessdenoland deno

CVE-2026-49860Deno: WebSocket API sandbox bypass via missing post-DNS checkdenoland deno

CVE-2026-49859Deno: `fetch()` API sandbox bypass via missing DNS resolution checkdenoland deno

CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Roundsdenoland deno

CVE-2026-49411Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checksdenoland deno

CVE-2026-49406Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictionsdenoland deno

CVE-2026-49402Deno: Command Injection via spawnSync & spawn on Windowsdenoland deno

CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)denoland deno

CVE-2026-44726Deno: TLS retry copies stale upgrade hook, risking plaintext trafficdenoland deno

CVE-2026-32260Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)denoland deno

CVE-2026-27190Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processdenoland deno

CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypassdenoland deno

CVE-2026-22863Deno node:crypto doesn't finalize cipherdenoland deno

CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Executiondenoland deno

CVE-2025-61786Deno's --deny-read check does not prevent permission bypassdenoland deno

CVE-2025-61785Deno's --deny-write check does not prevent permission bypassdenoland deno

CVE-2025-55195@std/toml Prototype Pollution in Node.js and Browserdenoland std

CVE-2025-48935Deno has --allow-read / --allow-write permission bypass in `node:sqlite`denoland deno

CVE-2025-48934Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variablesdenoland deno

CVE-2025-48888Deno run with --allow-read and --deny-read flags results in alloweddenoland deno

CVE-2025-24015Deno's AES GCM authentication tags are not verifieddenoland deno

CVE-2025-21620Deno's authorization headers not dropped when redirecting cross-origindenoland deno

CVE-2024-52793XSS vulnerability in serveDir API of @std/http/file-server on POSIX systemsdenoland std

CVE-2024-37150Private npm registry support used scope auth token for downloading tarballsdenoland deno

CVE-2024-34346Deno contains a permission escalation via open of privileged files with missing `--deny` flagdenoland deno

CVE-2024-32477Race condition when flushing input stream leads to permission prompt bypassdenoland deno

CVE-2024-32468Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generatordenoland deno

CVE-2024-27936Deno interactive permission prompt spoofing via improper ANSI strippingdenoland deno

CVE-2024-27935Deno's Node.js Compatibility Runtime has Cross-Session Data Contaminationdenoland deno

CVE-2024-27934*const c_void / ExternalPointer unsoundness leading to use-after-freedenoland deno

CVE-2024-27933Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassdenoland deno

CVE-2024-27932Deno's improper suffix match testing for DENO_AUTH_TOKENSdenoland deno

CVE-2024-27931Insufficient permission checking in `Deno.makeTemp*` APIsdenoland deno

CVE-2023-33966Deno missing "--allow-net" permission check for built-in Node modulesdenoland deno

CVE-2023-28446Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralizationdenoland deno

CVE-2023-28445Deno improperly handles resizable ArrayBufferdenoland deno

CVE-2023-22499Interactive permission prompt spoofing in Denodenoland deno

CVE-2022-24783Sandbox bypass leading to arbitrary code execution in Denodenoland deno

CVE-2021-32619Static imports inside dynamically imported modules do not adhere to permission checksdenoland deno

40 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.