624 matches found
GHSA-CHQV-56WV-7564 Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook tha...
CVE-2026-49406
creationtimestamp| type| source ---|---|--- 2026-05-27 13:09:16+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q...
CVE-2026-49402
creationtimestamp| type| source ---|---|--- 2026-05-27 13:08:13+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8 2026-06-17 10:36:55+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3moi4lqjxxk2f 2026-07-23 00:07:07+00:00| seen|...
CVE-2026-44726
creationtimestamp| type| source ---|---|--- 2026-05-27 13:04:30+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564...
PT-2026-44129
Name of the Vulnerable Software and Affected Versions Deno versions 2.0.0 through 2.7.7 Description A flaw in the Node.js tls compatibility layer can cause a TLS client to transmit application data in plaintext after a connection retry. This occurs when the autoSelectFamily variable is enabled an...
Fake software on GitHub and SourceForge distribute Deno RAT
During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links ...
CVE-2026-41690
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that...
GHSA-3V94-MW7P-V465 vulnerabilities
Vulnerabilities for packages: linkerd2-proxy, vector, shadowsocks-rust, ztunnel, deno...
GHSA-Q2QQ-HMJ6-3WPP vulnerabilities
Vulnerabilities for packages: linkerd2-proxy, vector, shadowsocks-rust, ztunnel, deno...
GHSA-3V94-MW7P-V465 vulnerabilities
Vulnerabilities for packages: linkerd2-proxy, vector, komodo, ztunnel, ztunnel-fips, deno, shadowsocks-rust...
GHSA-Q2QQ-HMJ6-3WPP vulnerabilities
Vulnerabilities for packages: linkerd2-proxy, vector, komodo, ztunnel, ztunnel-fips, deno, shadowsocks-rust...
GHSA-XP3W-R5P5-63RR vulnerabilities
Vulnerabilities for packages: vector, sccache, rpm-sequoia, rustup, deno, sdp-k8s-injector, sqlx...
CVE-2026-42327 vulnerabilities
Vulnerabilities for packages: vector, sccache, rpm-sequoia, rustup, deno, sdp-k8s-injector, sqlx...
CVE-2026-42327 vulnerabilities
Vulnerabilities for packages: vector, rpm-sequoia, rustls-openssl-client, sdp-k8s-injector, typst, komodo, sentry-cli, sccache, sqlx, rustup, valkey-ldap, deno, ztunnel-fips, guestproxyagent, bootc...
GHSA-XP3W-R5P5-63RR vulnerabilities
Vulnerabilities for packages: vector, rpm-sequoia, rustls-openssl-client, sdp-k8s-injector, typst, komodo, sentry-cli, sccache, sqlx, rustup, valkey-ldap, deno, ztunnel-fips, guestproxyagent, bootc...
CVE-2026-41898 vulnerabilities
Vulnerabilities for packages: vector, rpm-sequoia, rustls-openssl-client, sdp-k8s-injector, typst, komodo, sentry-cli, sccache, sqlx, rustup, valkey-ldap, deno, ztunnel-fips, guestproxyagent, bootc...
CVE-2026-41898 vulnerabilities
Vulnerabilities for packages: vector, sccache, rpm-sequoia, rustup, deno, sdp-k8s-injector, sqlx...
JLSEC-2026-105 Deno's `deno_runtime` vulnerable to interactive permission prompt spoofing via improper ANSI stripping
Summary A maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Details In the patch for CVE-2023-28446, Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to t...
JLSEC-2026-106
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between libc::tcflush0, libc::TCIFLUSH and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the...