crates.io (Rust)

Deno Security Analysis

Deno has 24 known security vulnerabilities in crates.io (Rust). Upgrade to version 2.8.1 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

24 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 2.8.1

Upgrading to 2.8.1 or later resolves all 24 known vulnerabilities in Deno. Update Cargo.toml: Deno = "2.8.1"

Is Deno in your project?

Check if you're affected and upgrade to 2.8.1 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Vulnerabilities

24 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2023-28445 Deno improperly handles resizable ArrayBuffer	CRITICAL	9.9	—	Deno improperly handles resizable ArrayBuffer	1.32.0	1.32.1
CVE-2026-22863 Deno node:crypto doesn't finalize cipher	CRITICAL	8.6	—	Deno node:crypto doesn't finalize cipher	All versions	2.6.0
CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno	CRITICAL	10.0	—	Sandbox bypass leading to arbitrary code execution in Deno	All versions	1.20.3
CVE-2021-32619 Deno's static imports inside dynamically imported modules do not adhere to permission checks	CRITICAL	9.8	—	Deno's static imports inside dynamically imported modules do not adhere to permission checks	All versions	1.10.2
CVE-2026-49402 Deno: Command Injection via spawnSync & spawn on Windows	HIGH	8.1	—	Deno: Command Injection via spawnSync & spawn on Windows	All versions	2.7.10
CVE-2024-27936 Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping	HIGH	8.8	—	Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping	All versions	1.41.0
CVE-2026-32260 Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process	HIGH	8.1	—	Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process	All versions	2.7.2
CVE-2026-27190 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process	HIGH	8.1	—	Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process	All versions	2.6.8
CVE-2026-22864 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass	HIGH	8.1	—	Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass	All versions	2.5.6
CVE-2025-61787 Deno is Vulnerable to Command Injection on Windows During Batch File Execution	HIGH	8.1	—	Deno is Vulnerable to Command Injection on Windows During Batch File Execution	All versions	2.5.2
CVE-2023-28446 Interactive `run` permission prompt spoofing via improper ANSI neutralization	HIGH	8.8	—	Interactive `run` permission prompt spoofing via improper ANSI neutralization	All versions	1.31.2
CVE-2023-33966 Missing "--allow-net" permission check for built-in Node modules	HIGH	8.6	—	Missing "--allow-net" permission check for built-in Node modules	1.34.0	1.34.1
CVE-2024-34346 Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag	HIGH	8.4	—	Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag	All versions	1.43.1
CVE-2024-27934 *const c_void / ExternalPointer unsoundness leading to use-after-free	HIGH	8.4	—	*const c_void / ExternalPointer unsoundness leading to use-after-free	All versions	1.40.3
CVE-2023-22499 Deno is vulnerable to race condition via interactive permission prompt spoofing	HIGH	8.8	—	Deno is vulnerable to race condition via interactive permission prompt spoofing	All versions	1.29.3
CVE-2026-49440 Deno: Miller-Rabin Primality Test Allows Zero Rounds	HIGH	7.4	—	Deno: Miller-Rabin Primality Test Allows Zero Rounds	All versions	2.8.1
CVE-2026-44726 Deno's TLS retry copies stale upgrade hook, risking plaintext traffic	HIGH	7.4	—	Deno's TLS retry copies stale upgrade hook, risking plaintext traffic	All versions	2.7.8
CVE-2025-21620 fetch: Authorization headers not dropped when redirecting cross-origin	HIGH	7.5	—	fetch: Authorization headers not dropped when redirecting cross-origin	All versions	2.1.2
CVE-2026-49401 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)	HIGH	7.3	—	Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)	All versions	2.7.14
CVE-2024-27933 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass	HIGH	8.2	—	Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass	1.39.0	1.39.1
CVE-2025-24015 Deno's AES GCM authentication tags are not verified	HIGH	7.5	—	Deno's AES GCM authentication tags are not verified	All versions	2.1.7
CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination	HIGH	7.2	—	Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination	All versions	1.36.3
CVE-2025-48935 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`	MEDIUM	9.1	—	Deno has --allow-read / --allow-write permission bypass in `node:sqlite`	All versions	2.2.5
CVE-2026-49411 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks	MEDIUM	6.5	—	Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks	All versions	2.8.0

About This Data

Vulnerability data for Deno is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Related crates.io (Rust) Packages

Other packages in this ecosystem, ranked by shared vulnerabilities where available.

wasmtime surrealdb zebrad openssl-src

Check Your Dependencies

Scan your project to check if you're using a vulnerable version of Deno.

Start Free Scan Create Free Account

Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed