deno has 9 CVEs on record between 2021 and 2026. Disclosures have slowed: 0 in the last 90 days after 8 in the 90 before. The busiest recent month was June 2026 with 7. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 8
Worst active — by depth score
CVE-2021-32619Critical· 9.8Deno's static imports inside dynamically imported modules do not adhere to permission checks54CVE-2026-49402High· 8.1Deno: Command Injection via spawnSync & spawn on Windows45CVE-2026-49440High· 7.4Deno: Miller-Rabin Primality Test Allows Zero Rounds41CVE-2026-44726High· 7.4Deno's TLS retry copies stale upgrade hook, risking plaintext traffic41CVE-2026-49411Medium· 6.5Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks36
deno vulnerabilities
CVEs affecting deno, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-49859Medium· 5.2Deno: `fetch()` API sandbox bypass via missing DNS resolution check
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
CVE-2026-49860Medium· 5.2Deno: WebSocket API sandbox bypass via missing post-DNS check
Deno: WebSocket API sandbox bypass via missing post-DNS check
CVE-2026-49402High· 8.1Deno: Command Injection via spawnSync & spawn on Windows
Deno: Command Injection via spawnSync & spawn on Windows
CVE-2026-49440High· 7.4Deno: Miller-Rabin Primality Test Allows Zero Rounds
Deno: Miller-Rabin Primality Test Allows Zero Rounds
CVE-2026-49411Medium· 6.5Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
CVE-2026-49406Medium· 5.5Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
CVE-2026-49401Medium· 5.2Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-44726High· 7.4Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
CVE-2021-32619Critical· 9.8Deno's static imports inside dynamically imported modules do not adhere to permission checks
Deno's static imports inside dynamically imported modules do not adhere to permission checks