deno
v2.9.8A modern runtime for JavaScript and TypeScript.
- Maintenance
- Active110 commits in 3 months · bus factor 5
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories1 critical, 16 high, 10 medium, 3 low · Scorecard 5.4/10
- Supported versions
- 1 line supportednewest 2.9 · 10 ended
109k stars · 7.4k forks · 1.7k open issues · last release 24 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 1 critical, 16 high, 10 medium, 3 low. Check the patched version against the one you run.
- mediumCVE-2026-55517Jun 17, 2026Denial of service via non-ASCII bytes in WebSocket response headers
- Affected
- <= 2.7.4
- Patched in
- 2.7.5
- highCVE-2026-49401May 27, 2026Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- Affected
- <= 2.7.13
- Patched in
- 2.7.14
- mediumCVE-2026-49406May 27, 2026BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
- Affected
- <=2.7.11
- Patched in
- 2.7.12
- mediumCVE-2026-49411May 27, 2026Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
- Affected
- 2.7.14
- Patched in
- 2.8.0
- highCVE-2026-49440May 27, 2026Miller-Rabin Primality Test Allows Zero Rounds
- Affected
- <= 2.8.0
- Patched in
- 2.8.1
- highCVE-2026-49402May 27, 2026Command Injection via spawnSync & spawn on Windows
- Affected
- < v2.7.10
- Patched in
- v2.7.10
- mediumCVE-2026-49983May 27, 2026process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
- Affected
- <= 2.8.0
- Patched in
- 2.8.1
- mediumCVE-2026-49859May 27, 2026`fetch()` API sandbox bypass via missing DNS resolution check
- Affected
- <= 2.8.0
- Patched in
- 2.8.1
- mediumCVE-2026-49860May 27, 2026WebSocket API sandbox bypass via missing post-DNS check
- Affected
- <= 2.8.0
- Patched in
- 2.8.1
- highCVE-2026-44726May 27, 2026TLS retry copies stale upgrade hook, risking plaintext traffic
- Affected
- >=2.0.0
- Patched in
- 2.7.8
- highCVE-2026-32260Mar 12, 2026Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
- Affected
- >= v2.7.0
- Patched in
- 2.7.2
- highCVE-2026-27190Feb 19, 2026Command Injection via Incomplete shell metacharacter blocklist in `node:child_process`
- Affected
- 2.6.7
- Patched in
- 2.6.8
- highCVE-2026-22864Jan 15, 2026Incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
- Affected
- < 2.5.6
- Patched in
- 2.5.6
- criticalCVE-2026-22863Jan 15, 2026`node:crypto` doesn't finalize cipher
- Affected
- <= 2.5.6
- Patched in
- 2.6.0
- highCVE-2025-61787Oct 7, 2025Command Injection on Windows
- Affected
- <=2.5.1
- Patched in
- 2.2.15, 2.5.2
- lowCVE-2025-61786Oct 7, 2025Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSyn --deny-read permission bypass
- Affected
- <=2.5.2
- Patched in
- 2.2.15, 2.5.3
- lowCVE-2025-61785Oct 7, 2025Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync --deny-write permission bypass
- Affected
- <=2.5.2
- Patched in
- 2.2.15, 2.5.3
- mediumCVE-2024-21486Jun 3, 2025Exposure of sensitive information using static imports
- Affected
- <2.0.0
- Patched in
- 2.0.0
- mediumCVE-2025-24015Jun 3, 2025AES GCM authentication tags are not verified
- Affected
- > 1.46.0 <= 2.1.6
- Patched in
- 2.1.7
- mediumCVE-2025-48934Jun 3, 2025Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
- Affected
- <=2.1.12, <=2.2.12
- Patched in
- 2.1.13, >=2.2.13
- highCVE-2025-48935Jun 3, 2025--allow-read / --allow-write permission bypass in `node:sqlite`
- Affected
- >= 2.2.0
- Patched in
- >= 2.2.5
- lowCVE-2025-48888Jun 3, 2025deno run with --allow-read and --deny-read flags results in allowed
- Affected
- >= 1.41.3
- Patched in
- 2.1.13, 2.2.13, >=2.3.3
- highCVE-2025-21620Jan 6, 2025fetch: Authorization headers not dropped when redirecting cross-origin
- Affected
- >=0.0.1; <1.46.4, <2.1.2
- Patched in
- 0.204.0; 2.1.2
- mediumCVE-2024-32468Nov 25, 2024Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator
- Affected
- <0.119.0; <1.42.0
- Patched in
- 0.119.0; 1.42.0
- highCVE-2024-37150Jun 6, 2024Private npm registry support used scope auth token for downloading tarballs
- Affected
- 1.44.0
- Patched in
- 1.44.1
- highCVE-2024-34346May 7, 2024Permission escalation via open of privileged files with missing `--deny` flag
- Affected
- < 1.43.0
- Patched in
- 1.43.1
- highCVE-2024-32477Apr 18, 2024Race condition when flushing input stream leads to permission prompt bypass
- Affected
- < 1.42.2
- Patched in
- 1.42.2
- highCVE-2024-27936Mar 5, 2024Interactive permission prompt spoofing via improper ANSI stripping
- Affected
- >= 0.103.0, < 0.147.0; >= 1.32.1, < 1.41.0
- Patched in
- 0.147.0; 1.41.0
- highCVE-2024-27935Mar 5, 2024Cross-Session Data Contamination in Deno's Node.js Compatibility Runtime
- Affected
- > 1.35.1
- Patched in
- 1.36.3
- highCVE-2024-27933Mar 5, 2024Arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
- Affected
- 1.39.0
- Patched in
- 1.39.1