Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N C H N N 6.5 .0014 4.2 —
AFFECTED Product Versions Fixed deno < 2.8.0 – —
TIMELINE May 29 Reserved by GitHub_M Jun 23 EXPLOIT PUBLISHED — CVE-2026-49411 (denoland deno). Public exploit reference added. Jun 23 Published (CNA: GitHub_M)
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.
| Date | Event | Detail |
|---|---|---|
| May 29, 2026 | Reserved | Reserved by GitHub_M |
| June 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-49411 (denoland deno). Public exploit reference added. |
| June 23, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| denoland | deno | — | < 2.8.0 | — |
Authoritative record: CVE-2026-49411 at cve.org
Vendors: denoland
Weaknesses: CWE-284
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49411 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.