---
id: CVE-2026-55517
title: 'Deno is a JavaScript, TypeScript, and WebAssembly runtime'
summary: >-
  Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a
  Deno program that opens a client WebSocket connection could be crashed by the
  remote server. While handling the WebSocket handshake response, Deno parsed
  the Se…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-248
published: '2026-06-23'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55517'
references:
  - url: 'https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00315
epssPercentile: 0.21816
ingestedAt: '2026-06-29T13:42:11.982Z'
---

## Overview

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.