CVE-2026-49860

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1

Description When opening a WebSocket connection, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses the hostname resolves to. This allows an attacker-controlled script to use a specially crafted domain name that passes the hostname check but resolves to a denied IP, bypassing network isolation rules. This can lead to unauthorized connections to hosts the user intended to block, such as localhost or internal services, potentially via a malicious or compromised dependency.

Recommendations Update to version 2.8.1. Avoid granting --allow-net to untrusted code that relies on --deny-net restrictions for security if an immediate update is not possible.