CVE-2026-49411

MediumCVSS 6.5/10Last modified Jun 26, 2026

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2026
Last modified: Jun 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-494127.8The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the CVE-2026-494137.1The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this fl CVE-2026-494147.8The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rat CVE-2026-494158.8During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this windo CVE-2026-494167.8The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buff CVE-2026-494177.0Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memo CVE-2026-494188.8When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid b CVE-2026-494198.8When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before lo CVE-2026-49427.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security CVE-2026-494208.8The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in th CVE-2026-494217.1The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the CVE-2026-494228.4The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacq