CVE-2026-55517— Deno: Denial of service via non-ASCII bytes in WebSocket response headers
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55517
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Deno: Denial of service via non-ASCII bytes in WebSocket response headers
Source: NVD (National Vulnerability Database)
Vulnerability Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
未捕获的异常
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-55517
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55517
请登录查看更多情报信息。
Other References for CVE-2026-55517 (1)
Same Patch Batch · denoland · 2026-06-23 · 10 CVEs total
| CVE-2026-49402 | 8.1 HIGH | Deno: Command Injection via spawnSync & spawn on Windows |
| CVE-2026-49440 | 7.4 HIGH | Deno: Miller-Rabin Primality Test Allows Zero Rounds |
| CVE-2026-44726 | 7.4 HIGH | Deno: TLS retry copies stale upgrade hook, risking plaintext traffic |
| CVE-2026-49401 | 7.3 HIGH | Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) |
| CVE-2026-49411 | 6.5 MEDIUM | Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks |
| CVE-2026-49406 | 5.5 MEDIUM | Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow |
| CVE-2026-49983 | 5.2 MEDIUM | Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with on |
| CVE-2026-49860 | 5.2 MEDIUM | Deno: WebSocket API sandbox bypass via missing post-DNS check |
| CVE-2026-49859 | 5.2 MEDIUM | Deno: `fetch()` API sandbox bypass via missing DNS resolution check |
IV. Related Vulnerabilities
Same product: deno
- CVE-2026-44726
Deno: TLS retry copies stale upgrade hook, risking plaintext - CVE-2026-49401
Deno Permission Bypass via Unicode Normalization Mismatch on - CVE-2026-49402
Deno: Command Injection via spawnSync & spawn on Windows - CVE-2026-49406
Deno: BYONM module resolution allows `package.json` main pat - CVE-2026-49411
Deno Node TCPWrap numeric hostname aliases bypass --deny-net
Same vendor: denoland
- CVE-2026-44726
Deno: TLS retry copies stale upgrade hook, risking plaintext - CVE-2026-49401
Deno Permission Bypass via Unicode Normalization Mismatch on - CVE-2026-49402
Deno: Command Injection via spawnSync & spawn on Windows - CVE-2026-49406
Deno: BYONM module resolution allows `package.json` main pat - CVE-2026-49411
Deno Node TCPWrap numeric hostname aliases bypass --deny-net
Same weakness: CWE-248
- CVE-2026-50129
Mastodon: Persistent anonymous DoS via unhandled NoMethodErr - CVE-2026-12644
ts-deepmerge<8.0.0对象原型处理不当致应用崩溃 - CVE-2026-46689
Kanidm: Unauthenticated process abort via SCIM filter stack - CVE-2026-46545
nimiq-primitives: Panic DoS in trie chunk processing via ROO - CVE-2026-46411
FlashMQ: Client can trigger uncaught exception on FlashMQ 1.
V. Comments for CVE-2026-55517
No comments yet