CVE-2026-44726

creationtimestamp| type| source ---|---|--- 2026-05-27 13:04:30+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564...

PT-2026-44129

Name of the Vulnerable Software and Affected Versions Deno versions 2.0.0 through 2.7.7 Description A flaw in the Node.js tls compatibility layer can cause a TLS client to transmit application data in plaintext after a connection retry. This occurs when the autoSelectFamily variable is enabled an...

Fake software on GitHub and SourceForge distribute Deno RAT

During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links ...

CVE-2026-41690

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that...

GHSA-3V94-MW7P-V465 vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, vector, deno, linkerd2-proxy, ztunnel...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, vector, deno, linkerd2-proxy, ztunnel...

GHSA-3V94-MW7P-V465 vulnerabilities

Vulnerabilities for packages: komodo, vector, ztunnel-fips, shadowsocks-rust, deno, linkerd2-proxy, ztunnel...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: komodo, vector, ztunnel-fips, shadowsocks-rust, deno, linkerd2-proxy, ztunnel...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: rpm-sequoia, sqlx, rustup, sccache, vector, sdp-k8s-injector, deno...

CVE-2026-42327 vulnerabilities

Vulnerabilities for packages: rpm-sequoia, sqlx, rustup, sccache, vector, sdp-k8s-injector, deno...

CVE-2026-42327 vulnerabilities

Vulnerabilities for packages: rustls-openssl-client, rpm-sequoia, komodo, vector, sentry-cli, bootc, sdp-k8s-injector, sqlx, rustup, sccache, typst, ztunnel-fips, deno, valkey-ldap, guestproxyagent...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: rustls-openssl-client, rpm-sequoia, komodo, vector, sentry-cli, bootc, sdp-k8s-injector, sqlx, rustup, sccache, typst, ztunnel-fips, deno, valkey-ldap, guestproxyagent...

CVE-2026-41898 vulnerabilities

Vulnerabilities for packages: rustls-openssl-client, rpm-sequoia, komodo, vector, sentry-cli, bootc, sdp-k8s-injector, sqlx, rustup, sccache, typst, ztunnel-fips, deno, valkey-ldap, guestproxyagent...

CVE-2026-41898 vulnerabilities

Vulnerabilities for packages: rpm-sequoia, sqlx, rustup, sccache, vector, sdp-k8s-injector, deno...

JLSEC-2026-98 Deno's static imports inside dynamically imported modules do not adhere to permission checks

Impact Modules that are dynamically imported through import or new Worker might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing especially transitively untrusted code are...

JLSEC-2026-114 Deno node:crypto doesn't finalize cipher

Summary The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. PoC js import crypto from "node:crypto"; const key = crypto.randomBytes32; const iv =...

JLSEC-2026-99

Deno =1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory...

JLSEC-2026-111 Deno's --deny-write check does not prevent permission bypass

Summary Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync are not limited by the permission model check --deny-write=./. It's possible to change to change the access atime and modification mtime times on the file stream resource even when the file is opened with read only permission...

JLSEC-2026-109 Deno run with --allow-read and --deny-read flags results in allowed

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, deno run --allow-read --deny-read main.ts results in allowed, even though 'deny' should be stronger. The result is the same with all global unary permissions give...

JLSEC-2026-105 Deno's `deno_runtime` vulnerable to interactive permission prompt spoofing via improper ANSI stripping

Summary A maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Details In the patch for CVE-2023-28446, Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to t...